Loading story…
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to COLDRIVER—also tracked as Star Blizzard, Callisto, TA446, Blue Charlie, and UNC4057—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as COLDWASTREL.
The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Citizen Lab published a detailed report on the 'River of Phish' spear-phishing campaign targeting Russian opposition figures, journalists, NGOs, funders, media, and policy experts across multiple countries. The report attributed the activity to COLDRIVER and documented overlaps with prior infrastructure and lures, while also distinguishing a separate cluster named COLDWASTREL.
Access Now’s Digital Security Helpline and the Citizen Lab, with partner organizations, disclosed at least two spear-phishing campaigns targeting Russian and Belarusian civil society, independent media, international NGOs in Eastern Europe, and at least one former U.S. ambassador. They attributed one campaign to COLDRIVER and identified a second distinct actor they named COLDWASTREL.
Investigators began tracking activity later attributed to the newly named COLDWASTREL phishing cluster after receiving reports of attacks targeting civil society communities. The campaign used social engineering and infrastructure impersonating prominent Eastern European civil society organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 113 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
7 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourceaccessnow.org
Open sourcecitizenlab.ca
Open sourceblog.google
Open sourceblog.sekoia.io
Open sourcecepa.org
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government publicly attributed a long-running cyber campaign against democratic institutions and politicians’ personal email accounts to officers of **Centre 18** of Russia’s **FSB**, identifying the activity under names including **COLDRIVER**, **Star Blizzard**, **SEABORGIUM**, **Callisto**, and **BlueCharlie**. Officials said the operation had run since at least 2015, included the compromise of then trade minister Liam Fox’s email in 2019, and involved the selective leaking of stolen material later cited during a UK election campaign. In response, London summoned the Russian ambassador and sanctioned **Ruslan Peretyatko** and **Andrew Korinets** following a National Crime Agency investigation. Security researchers said the group has continued refining its credential-harvesting tradecraft to evade detection, replacing exposed infrastructure with dozens of new domains and using legitimate cloud services such as **Google Docs** and **Microsoft OneDrive** as phishing lures. Prior reporting linked the actor to **Evilginx**-based phishing kits designed to steal credentials and MFA tokens, with targets spanning governments, defense organizations, think tanks, NGOs, journalists, and academic institutions across Europe and North America. Microsoft warned that the actor’s ongoing attacks show increased sophistication and evasion, underscoring that the campaign remains active despite public exposure and sanctions.
Aug 15, 2026
The Russian state-linked advanced persistent threat group COLDRIVER, also known as Star Blizzard, Callisto, and UNC4057, has expanded its cyber-espionage toolkit by launching a new campaign utilizing novel malware payloads. In this operation, COLDRIVER has introduced the BAITSWITCH and SIMPLEFIX payloads, which are delivered through a ClickFix-like campaign targeting individuals and organizations associated with civil society, NGOs, human rights defenders, and think tanks, particularly those with connections to Russia or residing in Western regions. The campaign employs malicious CAPTCHA checks to deceive victims into executing the BAITSWITCH DLL via the Windows Run dialog box. Once executed, BAITSWITCH retrieves the SIMPLEFIX payload, which enables the execution of PowerShell scripts, commands, and remote binaries hosted on external URLs, thereby granting attackers significant control over compromised systems. Security researchers from Zscaler ThreatLabz have highlighted that this campaign closely aligns with COLDRIVER’s established victimology, focusing on entities critical of or exiled from Russia. The use of these new malware strains demonstrates COLDRIVER’s ongoing efforts to update and diversify its attack arsenal, making detection and mitigation more challenging for defenders. The campaign’s technical sophistication is evident in its use of social engineering tactics, such as fake CAPTCHA prompts, to bypass user suspicion and security controls. The deployment of BAITSWITCH and SIMPLEFIX represents a notable evolution from previous COLDRIVER operations, which relied on more traditional phishing and malware delivery methods. The campaign’s infrastructure allows for flexible payload delivery, enabling attackers to adapt their tactics based on the target’s environment. Security analysts have warned that the campaign’s focus on civil society organizations increases the risk of sensitive information theft and potential disruption of advocacy activities. The operation’s timing coincides with heightened geopolitical tensions, further raising concerns about the potential for state-sponsored cyber-espionage to influence international affairs. Defensive recommendations include heightened vigilance for suspicious CAPTCHA prompts, monitoring for unusual DLL executions, and restricting PowerShell and remote binary execution where possible. The campaign underscores the persistent threat posed by Russian APT groups to Western civil society and the need for robust security awareness and technical controls. Organizations are advised to review their security postures and update detection mechanisms to identify the new BAITSWITCH and SIMPLEFIX payloads. The ongoing evolution of COLDRIVER’s tactics highlights the importance of continuous threat intelligence sharing and collaboration among targeted sectors. Security vendors and researchers continue to monitor the campaign for further developments and potential expansion of targeting. The incident serves as a reminder of the sophisticated and adaptive nature of state-linked cyber-espionage operations.
Jun 29, 2026
A Russia-linked threat actor known as Callisto, also referred to as ColdRiver or Star Blizzard, attempted to compromise the nonprofit organization Reporters Without Borders (RSF) through a sophisticated phishing campaign. The attack involved credential-harvesting tactics, including the use of a ProtonMail account impersonating a trusted contact and a lure referencing a missing file. The phishing email, written in French and using a legitimate signature, prompted the recipient to request a follow-up document, after which a malicious link was sent. This link redirected the target to a spoofed ProtonMail login page designed to steal credentials. The campaign leveraged advanced adversary-in-the-middle (AiTM) phishing techniques and social engineering, with the attacker switching languages and using compromised websites to host malicious content. RSF, which supports journalists under threat and has been labeled an "undesirable organization" by the Kremlin, was specifically targeted, highlighting the ongoing focus of Russian APTs on NGOs and organizations supporting Ukraine. The attack was ultimately thwarted when ProtonMail blocked the attacker's account, preventing the malicious file from being delivered. Security researchers noted that similar lures were used against other organizations, and the campaign reflects a broader trend of Russian APTs using custom phishing kits and social engineering to target high-profile entities. The incident underscores the persistent threat posed by Russian state-aligned actors to civil society organizations and the need for robust email security and user awareness training.
Jun 29, 2026