Fraud campaign impersonates Russian companies to steal funds

Per The Hacker News, a sophisticated, long-running fraud campaign has been uncovered, where threat actors create fake websites impersonating major Russian companies to deceive international businesses and siphon funds. This operation has been active since 2017, according to F6.

The attackers meticulously clone legitimate websites of Russian firms across various sectors, including manufacturing, logistics, and banking. These fraudulent sites, available in multiple languages, are used to trick international clients into making advance payments for non-existent goods. The scheme primarily targets businesses in Commonwealth of Independent States countries, utilizing cold calls, phishing emails, and fake corporate websites to initiate contact and distribute fraudulent banking details of shell companies. In some instances, unsuspecting sales representatives are hired to make initial contact, with communications then handed over to the fraudsters for final negotiations. These actors then provide fake commercial offers, contracts, and invoices, directing payments to their own accounts. One Azerbaijani company reportedly lost $150,000 in April 2025.

Researchers have identified nearly 100 counterfeit domains linked to this coordinated campaign, with infrastructure sharing common DNS records and IP addresses. The campaign's evolution includes using .com, .org, and .net domains alongside earlier .ru domains, and even copying fraud warnings from legitimate company sites onto their fake counterparts. Businesses are advised to independently verify contact and payment details, check domain registration dates, and use trusted sources to vet business partners.

Source: The Hacker News