Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments

A nine-year-old fraud campaign, originating in 2017, has been uncovered by cybersecurity firm F6, involving the creation of clone websites mimicking major Russian companies to steal advance payments from international clients. The attackers use lookalike domains and sophisticated tactics, including hiring sales representatives to push fraudulent transactions, and have successfully defrauded companies across the CIS region, with one victim losing $150,000 in April 2025. The campaign is characterized by a high degree of replication, with attackers quickly copying fraud warnings from legitimate victims onto their fake sites.