Loading story…
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to COLDRIVER—also tracked as Star Blizzard, Callisto, TA446, Blue Charlie, and UNC4057—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as COLDWASTREL.
The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Citizen Lab published a detailed report on the 'River of Phish' spear-phishing campaign targeting Russian opposition figures, journalists, NGOs, funders, media, and policy experts across multiple countries. The report attributed the activity to COLDRIVER and documented overlaps with prior infrastructure and lures, while also distinguishing a separate cluster named COLDWASTREL.
Access Now’s Digital Security Helpline and the Citizen Lab, with partner organizations, disclosed at least two spear-phishing campaigns targeting Russian and Belarusian civil society, independent media, international NGOs in Eastern Europe, and at least one former U.S. ambassador. They attributed one campaign to COLDRIVER and identified a second distinct actor they named COLDWASTREL.
Investigators began tracking activity later attributed to the newly named COLDWASTREL phishing cluster after receiving reports of attacks targeting civil society communities. The campaign used social engineering and infrastructure impersonating prominent Eastern European civil society organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourceaccessnow.org
Open sourcecitizenlab.ca
Open sourceblog.google
Open sourceblog.sekoia.io
Open sourcecepa.org
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Russia-linked threat actor known as Callisto, also referred to as ColdRiver or Star Blizzard, attempted to compromise the nonprofit organization Reporters Without Borders (RSF) through a sophisticated phishing campaign. The attack involved credential-harvesting tactics, including the use of a ProtonMail account impersonating a trusted contact and a lure referencing a missing file. The phishing email, written in French and using a legitimate signature, prompted the recipient to request a follow-up document, after which a malicious link was sent. This link redirected the target to a spoofed ProtonMail login page designed to steal credentials. The campaign leveraged advanced adversary-in-the-middle (AiTM) phishing techniques and social engineering, with the attacker switching languages and using compromised websites to host malicious content. RSF, which supports journalists under threat and has been labeled an "undesirable organization" by the Kremlin, was specifically targeted, highlighting the ongoing focus of Russian APTs on NGOs and organizations supporting Ukraine. The attack was ultimately thwarted when ProtonMail blocked the attacker's account, preventing the malicious file from being delivered. Security researchers noted that similar lures were used against other organizations, and the campaign reflects a broader trend of Russian APTs using custom phishing kits and social engineering to target high-profile entities. The incident underscores the persistent threat posed by Russian state-aligned actors to civil society organizations and the need for robust email security and user awareness training.
Jun 29, 2026
A sophisticated spearphishing campaign, identified as PhantomCaptcha, targeted key organizations involved in Ukraine's war relief efforts, including the International Committee of the Red Cross (ICRC), UNICEF, the Norwegian Refugee Council, and various Ukrainian regional government administrations. The attackers impersonated the Ukrainian President’s Office, sending emails with weaponized PDF attachments designed to lure recipients into clicking malicious links. These links led to a fake Cloudflare captcha page, which was actually a 'ClickFix'-style decoy, ultimately delivering a multi-stage WebSocket-based remote access trojan (RAT). The infrastructure supporting this campaign was hosted on Russian-owned servers and was only active for a single day, indicating a high level of operational security and planning, with evidence suggesting at least six months of preparation. The campaign’s technical sophistication included the use of a convincing eight-page document and a redirection to a domain masquerading as a legitimate Zoom website, further enhancing the credibility of the phishing attempt. Once the RAT was deployed, it enabled the attackers to execute arbitrary remote commands, exfiltrate sensitive data, and potentially deploy additional malware on compromised systems. Investigators also discovered a mobile attack vector, with fake Android applications designed to harvest geolocation data, contacts, media files, and other sensitive information from targeted devices. The selection of targets suggests the attackers were seeking intelligence on humanitarian operations, reconstruction planning, and international coordination related to Ukraine. Ukrainian government administrations in the Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk regions were specifically named among the targets. The campaign’s rapid disappearance after a single day of activity points to a deliberate effort to avoid detection and forensic analysis. SentinelLabs, in collaboration with the Digital Security Lab of Ukraine, led the investigation and public disclosure of the campaign. The use of Russian infrastructure and the focus on Ukrainian and international relief organizations suggest a possible geopolitical motivation, though attribution remains unconfirmed. The attack chain was designed to bypass traditional security controls by exploiting trust in official communications and leveraging multi-stage payload delivery. The campaign highlights the ongoing threat to humanitarian and governmental organizations operating in conflict zones, particularly those involved in Ukraine. Security researchers emphasize the need for heightened vigilance and advanced detection capabilities to counter such highly targeted and transient threats. The incident underscores the importance of cross-organizational intelligence sharing and rapid response to emerging spearphishing campaigns. Organizations are advised to review their email security protocols, educate staff on phishing risks, and monitor for indicators of compromise associated with the PhantomCaptcha infrastructure.
Jun 29, 2026
Recorded Future’s Insikt Group reported sustained **credential-harvesting operations by Russia-linked APT28** (aka **BlueDelta/Fancy Bear**) targeting individuals tied to a Turkish energy and nuclear research agency, European think tanks, and organizations in **North Macedonia and Uzbekistan**. Activity observed from **February to September 2025** used regionally tailored lures aligned with Russian intelligence priorities around energy, defense, and policy, with victims redirected to legitimate sites after credential theft to reduce suspicion. The campaigns relied on **fake login portals** impersonating *Microsoft Outlook/OWA*, *Google*, and *Sophos VPN* to capture credentials, and used low-cost, resilient infrastructure including free hosting and tunneling services (e.g., `ngrok`, Webhook[.]site, InfinityFree, and Byet Internet Services) to host pages and exfiltrate data. Multiple operations incorporated **legitimate PDF lure documents** (e.g., think tank and foundation publications) to increase authenticity and bypass email security controls, reflecting continued emphasis on scalable credential theft rather than novel malware deployment.
Jun 29, 2026