Russia-linked Callisto group launched a phishing attempt against the nonprofit Reporters Without Borders in March 2025 to harvest credentials.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

In March 2025, the Russia-aligned hacking group known as Callisto, ColdRiver, or Star Blizzard attempted a phishing campaign targeting the nonprofit Reporters Without Borders (RSF). The group sent a French-language phishing email impersonating a trusted contact to an RSF core member, using a tactic where no attachment was initially included to prompt a follow-up request for malicious files. When requested, the attacker responded with a link intending to deliver a malicious PDF, though the file was inaccessible due to ProtonMail intervention. Callisto historically targets NGOs, government bodies, and Ukrainian support organizations and has links to Russia’s FSB. RSF had been designated an “undesirable organization” by Russia in August 2025. Another unnamed organization was targeted with a similar phishing lure which included a spoofed ProtonMail login page to harvest credentials. Callisto is known for cyber espionage campaigns in Eastern Europe aimed at Western governments, defense contractors, research institutions, and NGOs supporting Ukraine. The U.S.-based Free Russia Foundation linked a 2024 breach exposing thousands of internal documents to Callisto operations.

Classification

Confidence: High

The event clearly describes a hostile phishing campaign by a Russia-linked group targeting a nonprofit supporting journalists, attributed to Russia's FSB, with multiple supporting technical details and attribution by cybersecurity firms.

Source URL

https://therecord.media/phishing-attempt-reporters-without-borders-callisto-coldriver

Open source

Provenance

Publisher: hwt_web_submit
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 8, 2026, 21:59 UTC
Event time: Mar 1, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "c46a8905-36ae-443b-9288-4acc1c3322a1",
  "url": "https://therecord.media/phishing-attempt-reporters-without-borders-callisto-coldriver",
  "source": "hwt_web_submit",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "France",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "espionage",
    "phishing",
    "Callisto Group",
    "COLDRIVER",
    "Russia",
    "FSB",
    "journalists",
    "media",
    "cyberattacks"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "A Russia-linked cyber espionage group Callisto (also known as ColdRiver or Star Blizzard), associated with Russia’s FSB, conducted a phishing attack in March 2025 targeting Reporters Without Borders, a nonprofit supporting journalists including those endangered by Russia. The phishing email, written in French and impersonating a trusted contact, attempted credential harvesting through a multi-step approach involving fake document requests. ProtonMail blocked parts of the attack. RSF was criminalized in Russia as an undesirable organization in August 2025. Another similar phishing attempt targeted an unnamed entity, using a spoofed ProtonMail login page to steal credentials. Callisto has a history of targeting organizations linked to Ukraine, NATO, and Western governments for espionage. The US Free Russia Foundation linked an internal breach exposing sensitive documents to Callisto activities.",
  "summary_short": "Russia-linked Callisto group launched a phishing attempt against the nonprofit Reporters Without Borders in March 2025 to harvest credentials.",
  "summary_extended": "In March 2025, the Russia-aligned hacking group known as Callisto, ColdRiver, or Star Blizzard attempted a phishing campaign targeting the nonprofit Reporters Without Borders (RSF). The group sent a French-language phishing email impersonating a trusted contact to an RSF core member, using a tactic where no attachment was initially included to prompt a follow-up request for malicious files. When requested, the attacker responded with a link intending to deliver a malicious PDF, though the file was inaccessible due to ProtonMail intervention. Callisto historically targets NGOs, government bodies, and Ukrainian support organizations and has links to Russia’s FSB. RSF had been designated an “undesirable organization” by Russia in August 2025. Another unnamed organization was targeted with a similar phishing lure which included a spoofed ProtonMail login page to harvest credentials. Callisto is known for cyber espionage campaigns in Eastern Europe aimed at Western governments, defense contractors, research institutions, and NGOs supporting Ukraine. The U.S.-based Free Russia Foundation linked a 2024 breach exposing thousands of internal documents to Callisto operations.",
  "actor_primary": "Callisto",
  "target_primary": null,
  "location_text": "Reporters Without Borders, phishing email sent by Russia-linked Callisto group",
  "location_region": null,
  "location_coordinates_lat": 46.227638,
  "location_coordinates_lon": 2.213749,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event clearly describes a hostile phishing campaign by a Russia-linked group targeting a nonprofit supporting journalists, attributed to Russia's FSB, with multiple supporting technical details and attribution by cybersecurity firms.",
  "event_time_utc": "2025-03-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:46.197Z",
  "updated_at": "2026-11-08T21:59:13.407Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "minor",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: MinorAttribution: HighIndependence confirmedTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Mar 1, 2025, 00:00 UTC

Event time confidence

unknown

Location

Reporters Without Borders, phishing email sent by Russia-linked Callisto group

Primary actor

Callisto

Country

France

Tags

espionage, phishing, Callisto Group, COLDRIVER, Russia, FSB, journalists, media, cyberattacks

Loading signal...

{ "id": "c46a8905-36ae-443b-9288-4acc1c3322a1", "url": "https://therecord.media/phishing-attempt-reporters-without-borders-callisto-coldriver", "source": "hwt_web_submit", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "France", "source_reliability": "C", "info_credibility": "3", "tags": [ "espionage", "phishing", "Callisto Group", "COLDRIVER", "Russia", "FSB", "journalists", "media", "cyberattacks" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "A Russia-linked cyber espionage group Callisto (also known as ColdRiver or Star Blizzard), associated with Russia’s FSB, conducted a phishing attack in March 2025 targeting Reporters Without Borders, a nonprofit supporting journalists including those endangered by Russia. The phishing email, written in French and impersonating a trusted contact, attempted credential harvesting through a multi-step approach involving fake document requests. ProtonMail blocked parts of the attack. RSF was criminalized in Russia as an undesirable organization in August 2025. Another similar phishing attempt targeted an unnamed entity, using a spoofed ProtonMail login page to steal credentials. Callisto has a history of targeting organizations linked to Ukraine, NATO, and Western governments for espionage. The US Free Russia Foundation linked an internal breach exposing sensitive documents to Callisto activities.", "summary_short": "Russia-linked Callisto group launched a phishing attempt against the nonprofit Reporters Without Borders in March 2025 to harvest credentials.", "summary_extended": "In March 2025, the Russia-aligned hacking group known as Callisto, ColdRiver, or Star Blizzard attempted a phishing campaign targeting the nonprofit Reporters Without Borders (RSF). The group sent a French-language phishing email impersonating a trusted contact to an RSF core member, using a tactic where no attachment was initially included to prompt a follow-up request for malicious files. When requested, the attacker responded with a link intending to deliver a malicious PDF, though the file was inaccessible due to ProtonMail intervention. Callisto historically targets NGOs, government bodies, and Ukrainian support organizations and has links to Russia’s FSB. RSF had been designated an “undesirable organization” by Russia in August 2025. Another unnamed organization was targeted with a similar phishing lure which included a spoofed ProtonMail login page to harvest credentials. Callisto is known for cyber espionage campaigns in Eastern Europe aimed at Western governments, defense contractors, research institutions, and NGOs supporting Ukraine. The U.S.-based Free Russia Foundation linked a 2024 breach exposing thousands of internal documents to Callisto operations.", "actor_primary": "Callisto", "target_primary": null, "location_text": "Reporters Without Borders, phishing email sent by Russia-linked Callisto group", "location_region": null, "location_coordinates_lat": 46.227638, "location_coordinates_lon": 2.213749, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event clearly describes a hostile phishing campaign by a Russia-linked group targeting a nonprofit supporting journalists, attributed to Russia's FSB, with multiple supporting technical details and attribution by cybersecurity firms.", "event_time_utc": "2025-03-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:46.197Z", "updated_at": "2026-11-08T21:59:13.407Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "minor", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }