Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian companies with an aim to siphon funds from international firms for more than nine years.
According to Russian cybersecurity vendor F6, the threat actors have set up clone websites of Russian companies across fertilizer manufacturers, petrochemical companies, metallurgical plants, logistics operators, and banks. The operation has been ongoing since 2017.
“Most of the content on these fraudulent websites was copied from the legitimate company websites. Some also used lookalike domain names,” the cybersecurity company said in an exclusive report shared with The Hacker News. “These fake websites, available in English, French, Arabic, and Russian, were used to target international customers and steal advance payments for goods that did not exist.”
Analysis indicates that the phony prepayment scheme has primarily singled out organizations across the Commonwealth of Independent States (CIS) countries with a specific focus on the business-to-business (B2B) sector and international trade via cold calls, phishing email campaigns, and fraudulent corporate websites to initiate contact with potential customers and distribute business documents containing the banking details of fake “subsidiary” companies.
The scheme works by deceiving potential clients into visiting the replica sites, which have the contact details altered to lead them to the attackers. Select instances have involved the threat actors hiring unsuspecting sales representatives to make cold calls, who are instructed to pass the customer to a “senior manager” once the negotiations reach the final stage.
From this point onwards, the customer’s communications are with the fraudsters, who then send commercial offers, contracts, and invoices with bogus bank details, causing payments to be routed to the criminals. One such victim, an Azerbaijani company, is estimated to have lost $150,000 in April 2025 through a fraudulent transaction.
F6’s investigation has unearthed nearly 100 counterfeit domains impersonating companies, with links identified between a subset of the infrastructure and prior campaigns. The earliest domain connected to the activity dates back to 2017. The vast majority of the domains are associated with the following IP addresses –
- 212.127.73[.]235
- 167.86.100[.]68
“A significant portion of the infrastructure shares common DNS records, IP addresses, and other registration data, indicating that these websites are part of a single coordinated campaign,” Elena Shamshina, technical lead of F6’s Threat Intelligence Department, said in a statement.
The cybersecurity company told The Hacker News that a similar fraudulent scheme unfolded in 2017 when a Russian chemical company began receiving phone calls from farmers about delayed deliveries of prepaid fertilizer orders. The farmers claimed to be in possession of contracts bearing the signatures of individuals who were believed to be company representatives, when, in reality, no such agreements had been signed.
Further investigation found evidence of a brandjacking effort where the scammers had created a fraudulent website (“www.agrocenter-eurohem[.]ru”) that was a near-perfect virtual copy of the legitimate website, with the only changes being the bank account details and contact information.
“The attackers had also produced highly convincing commercial proposals on the company’s official letterhead,” F6 said. “Although the documents appeared authentic, the payment details had been replaced with accounts controlled by the fraudsters. As a result, unsuspecting customers transferred money for goods that did not exist.”
The campaign is assessed to be international in nature. Although earlier iterations heavily relied on local .ru domains, the newly set up domains make extensive use of .com, .org, and .net top-level domains (TLDs). These websites are available in Russian, English, Arabic, and French.
F6 said it also discovered a set of fraudulent business documents mimicking commercial offers, contracts, and invoices containing fake corporate email addresses and fraudulent banking details.
“Analysis of these files indicates that the attackers prepare a complete set of business documentation designed to support the fake transaction and increase the victim’s confidence,” Vera Kolenikova, senior specialist of F6’s Cybercrime Investigation Department, said.
“As a result, victims lose money, while the legitimate companies whose brands are abused suffer reputational damage. For businesses engaged in international import and export operations, one of the most effective security measures is to independently verify contact information and payment details before transferring funds.”
Perhaps the most concerning aspect of the campaign is the level of replication involved. After several victim companies published fraud warnings on their official websites, the unknown threat actors wasted no time copying those notices onto their fake counterparts and replaced references to the legitimate domains with fake ones under their control.
To mitigate against the threat, organizations are advised to exercise due diligence on business partners using trusted sources and government business registries, ensure the legitimacy of subsidiaries and contact information, check the supplier’s website domain and registration date, and confirm payment details before transferring funds.
