In 2025, the Russia-nexus Calisto intrusion set used spearphishing, trusted-contact impersonation, and redirector-based credential harvesting (including AiTM-style tactics) to target NGOs and other entities linked to Ukraine support, including Reporters Without Borders.