← Back to Feed

Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments

July 29, 2026 · The Hacker News · Severity: MEDIUM

Cybersecurity firm F6 disclosed a large-scale fraud campaign operating since 2017 that clones websites of major Russian companies (fertilizer manufacturers, petrochemical companies, metallurgical plants, logistics operators, and banks) to steal advance payments from international firms. The fake websites, available in English, French, Arabic, and Russian, copy content from legitimate sites and use lookalike domain names. The operation targets the B2B sector in CIS countries, tricking victims into making prepayments for goods that do not exist.

Key Takeaways

  • A fraud campaign spanning nine years (since 2017) clones Russian company websites to trick international B2B buyers into making advance payments for nonexistent goods.
  • The operation targets multiple industries including fertilizer, petrochemical, metallurgy, logistics, and banking, with websites available in four languages.
  • Lookalike domain names and copied content from legitimate sites make the fraudulent websites difficult to distinguish from the real ones.
☕ Buy a Coffee