Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments

Executive Summary

A large-scale fraud campaign has been uncovered, involving the creation of clone websites of major Russian companies to siphon funds from international firms over a period of nine years. The campaign affects companies across various sectors, including fertilizer manufacturers and petrochemical companies. Immediate action is required to mitigate potential financial exposure and operational disruption.

Verified Facts

• The threat actors have set up clone websites of Russian companies — F6.
• The campaign has been ongoing for more than nine years — F6.
• The clone websites aim to siphon funds from international firms — The Hacker News.

Threat Classification

This threat can be classified as a fraud campaign, targeting various sectors, including fertilizer manufacturers and petrochemical companies, with a geographic scope focused on Russian companies and international firms. The exploitation status is active, with the attacker's motivation being financial gain (HIGH CONFIDENCE). The affected sectors include manufacturing and energy, with the campaign's scope being global.

Threat Severity Assessment

• Exploitability: HIGH - due to the campaign's ability to create convincing clone websites.
• Scope of impact: HIGH - affecting multiple sectors and companies worldwide.
• Prevalence: MEDIUM - as the campaign has been ongoing for nine years, but its scope and impact are still being assessed.

Business Impact

The potential business impact includes financial exposure through advance payments to fake companies, operational disruption due to potential supply chain interruptions, and reputational damage if companies are found to have fallen victim to the scam. Regulatory liability may also be a concern, particularly under laws such as GDPR, NIS2, DORA, and SOC 2, with potential penalties ranging from 2% to 4% of annual global turnover.

Technical Analysis

The attack vector involves creating clone websites of legitimate Russian companies to trick international firms into making advance payments. The exploitation chain likely involves social engineering and phishing tactics to convince victims of the legitimacy of the clone websites. Affected components include the websites of Russian companies and the financial systems of international firms.

CVE Analysis

No CVEs are explicitly mentioned in the article.

MITRE ATT&CK Mapping

• Tactic → T1566: Phishing - The threat actors use clone websites to phish international firms.
• Tactic → T1114: Email Collection - The threat actors likely collect email addresses to send phishing emails.

IOC Intelligence

No public IOCs are confirmed at the time of publication. However, defenders should build hunt rules around behavioral indicators such as suspicious website registrations, unusual payment requests, and phishing emails with spoofed sender addresses.

Detection Engineering Guidance

SIEM engineers should monitor logs for suspicious website registration activity, unusual payment requests, and phishing emails with spoofed sender addresses. Specific log sources include DNS logs, web server logs, and email server logs. Detection logic should focus on identifying patterns of phishing activity and suspicious financial transactions.

Sigma Rules

id: 123e4567-e89b-12d3-a456-426655440000
title: Clone Website Phishing
status: test
description: Detects phishing attempts using clone websites
logsource:
  category: web_server
detection:
  selection:
    url: '*clone*'
  condition: selection
falsepositives:
  - Legitimate website cloning for development purposes
tags:
  - T1566
level: medium

Threat Hunting Queries

• Hypothesis: Suspicious website registration — DNS logs.
• Hypothesis: Unusual payment requests — financial transaction logs.
• Hypothesis: Phishing emails with spoofed sender addresses — email server logs.
• Hypothesis: Clone website activity — web server logs.
• Hypothesis: Anomalous user behavior — user activity logs.

SOC Analyst Playbook

• P0: Immediately block suspicious website registrations and alert financial teams to potential phishing attempts.
• P1: Review DNS logs and web server logs for signs of clone website activity within the last 24 hours.
• P2: Conduct a thorough review of email server logs for phishing emails with spoofed sender addresses and alert users to potential threats.

Executive Decision Matrix

Executive Recommendations

• Day 1-7: Implement immediate technical measures to block suspicious website registrations and alert financial teams to potential phishing attempts.
• Day 8-30: Conduct a thorough review of security protocols and implement structural improvements to prevent similar threats.
• Day 31-90: Develop strategic program changes to enhance threat detection and response capabilities.

MSSP Opportunities

CYBERDUDEBIVASH SENTINEL APEX recommends that MSSPs prioritize client notification for exposed client segments, deploy detection rules for clone website phishing, and activate threat hunting for suspicious website registration activity.

Sentinel APEX Intelligence Correlation

CYBERDUDEBIVASH SENTINEL APEX detects and correlates this threat class through its live CVE tracking engine, MITRE ATT&CK correlation, real-time IOC feed integration, and Sigma rule library. The threat hunting workbench also enables proactive detection of clone website phishing attempts.

Predictive Intelligence

Based on the article, the most likely next threat actor move is to expand the scope of the campaign to target additional sectors and companies (MEDIUM CONFIDENCE). The threat actors may also evolve their tactics to include more sophisticated social engineering techniques (LOW CONFIDENCE).

Long-Term Strategic Risk

This specific threat fits into the evolving landscape of cyber threats, with a growing focus on social engineering and phishing attacks. Regulatory trajectory and threat actor capability evolution will likely lead to increased sophistication in these types of attacks, making it essential for companies to enhance their threat detection and response capabilities.

References

• The Hacker News - https://thehackernews.com/2026/07/nine-year-fraud-campaign.html
• F6 - https://www.f6.io/

🔗 Related Intelligence Resources

• → SENTINEL APEX Intelligence Platform

🔗 Related Intelligence Reports

• Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
• Tengu botnet reboots Linux devices to survive removal
• OpenAI explains how its AI agent breached Hugging Face
• Data Loss Risks During Microsoft 365 Migration and Ways to Prevent Them
• Laundry Bear’s webmail hackers had more in store after February, report says