Callisto Group | F-Secure Labs Malware Analysis

F‑Secure describes the Callisto Group, an advanced espionage-focused threat actor active since late 2015 that used targeted credential phishing to harvest webmail credentials and follow-up spear‑phishing with malicious .docx attachments embedding the 'Scout' backdoor from the HackingTeam RCS Galileo platform. Targets included military personnel, government officials, think‑tank staff, and journalists in Europe and the South Caucasus; the report provides TTPs, mitigation/remediation guidance, and IoCs (sample hash, C2 IP, numerous phishing domains).