Calisto was observed targeting a variety of academic institutions, think tanks, and research organizations. The attacks were aimed at stealing credentials for a U.S.-based grants management portal. The report on Calisto’s targeting came the same day that three of its members were sanctioned by the UK government.