Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
Summary: Researchers at Russian cybersecurity vendor F6 disclosed a fraud campaign running since 2017 that clones the websites of Russian fertilizer manufacturers, petrochemical companies, metallurgical plants, logistics operators, and banks to steal advance payments for goods that do not exist. The operation has produced nearly 100 counterfeit domains, uses cold calls, phishing emails, and fake contracts and invoices with bogus bank details, and one Azerbaijani company is estimated to have lost $150,000 in April 2025.
Key Takeaway: The scammers copied victim companies' own published fraud warnings onto their fake sites, so a buyer's check of the supplier's website can confirm the fraud rather than catch it. With nearly 100 domains and a single Azerbaijani victim down $150,000, the only reliable control left is verifying payment details independently before funds move.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026