Threat reportFraudTL-2026-1765
Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
Nine-Year Fraud Campaign Clones Russian Company Sites to (TL-2026-1765) is a medium-severity fraud campaign, first published 2026-07-29. It has no confirmed attribution, affects Russian fertilizer manufacturers Corporate website / brand identity, maps to 16 MITRE ATT&CK techniques (T1036.005, T1199, T1566.001), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-1765
- Threat ID
- TL-2026-1765
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- FRAUD
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- fertilizer manufacturing, petrochemicals, metallurgy, logistics, banking financial services, international b2b trade import-export
- Target regions
- Commonwealth of Independent States (CIS) — primary geographic focus per F6, azerbaijan, Middle East / North Africa (Arabic-language clone sites), Francophone markets (French-language clone sites), International B2B trade partners of Russian exporters (global)
- Detection rules
- 9
- Indicators of compromise
- 18
How Nine-Year Fraud Campaign Clones Russian Company Sites to works
A prepayment/advance-fee fraud operation active since 2017 has built nearly 100 lookalike websites cloning legitimate Russian fertilizer, petrochemical, metallurgical, logistics, and banking companies. Operators use forged business documents, fake corporate email addresses, cold-calling, and phishing to trick international B2B buyers into prepaying for goods that do not exist. Identified by Russian cybersecurity vendor F6; a documented Azerbaijani victim lost $150,000 in April 2025.
Since at least 2017, an unattributed, financially motivated fraud operation has built and maintained a large lookalike-website infrastructure impersonating major Russian companies across fertilizer manufacturing, petrochemicals, metallurgy, logistics, and banking. F6's Threat Intelligence Department (technical lead Elena Shamshina, with Vera Kolenikova of F6's Cybercrime Investigation Department) identified nearly 100 counterfeit domains tied to the operation. Most sites copy the full content, branding, and layout of the legitimate companies they impersonate, sometimes on exact domain names and sometimes on lookalike/typosquat variants (e.g., 'www.agrocenter-eurohem.ru', the earliest domain linked to the campaign, dating to 2017). Early-era sites relied heavily on .ru domains; more recent infrastructure has shifted toward .com, .org, and .net TLDs to appear more internationally credible, and the clone sites are served in Russian, English, Arabic, and French to reach international buyers across multiple regions.
The operation is not a technical exploit — there is no CVE, malware, or software vulnerability involved. Instead, operators combine the cloned websites with cold-calling by hired sales representatives and targeted phishing outreach to initiate contact with prospective international B2B buyers, typically importers of Russian commodities. Once contact is established, victims are sent a complete package of forged business documentation — commercial offers, contracts, and invoices reproduced on what appears to be the legitimate company's official letterhead, using fake corporate email addresses. The documents are visually convincing; the only substantive alteration is that banking/payment details are replaced with accounts controlled by the fraud operators. Victims wire advance/prepayment funds for goods (e.g., fertilizer or metals shipments) that are never delivered.
F6 assessed that a significant portion of the fraud infrastructure shares common DNS records, hosting IP addresses (including 212.127.73.235 and 167.86.100.68), and domain-registration data, indicating the nearly 100 sites are operated by a single coordinated group rather than disparate copy-cat actors. F6 further identified links between a subset of the infrastructure and prior fraud campaigns run by the same operators, indicating a persistent, evolving operation that has been iterating on its domain portfolio and tooling for close to a decade rather than a one-off scheme.
F6's disclosure identifies the Commonwealth of Independent States (CIS) as the primary geographic focus of the scheme, with the B2B sector and international trade specifically singled out; cold calls, phishing email campaigns, and the fraudulent corporate websites are used in combination to initiate contact within that focus region before expanding to other international buyers. F6 Cybercrime Investigation Department senior specialist Vera Kolenikova stated that analysis of the seized/observed forged files indicates the attackers prepare complete business documentation packages specifically to support fake transactions and increase victim confidence, rather than sending a single forged document in isolation. F6 also documented a defense-evasion behavior in which, after legitimate companies or partners posted public fraud warnings referencing the impersonators, the operators copied those warning notices onto their own fraudulent sites but replaced the referenced domain names — using the appearance of a legitimate anti-fraud notice to redirect victim suspicion away from the actual fraudulent domain being used against them. The clearest documented financial-impact case is an Azerbaijani company that lost $150,000 in April 2025 after transacting with cloned-site operators believing them to be a legitimate Russian supplier. Because the scheme relies entirely on social engineering and document forgery rather than a technical vulnerability, there is no patch; F6's guidance to prospective international buyers centers on independent verification of counterparties (business registries, WHOIS/domain-age checks, and out-of-band confirmation of banking details) before any advance payment is made.
MITRE ATT&CK techniques used in TL-2026-1765
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Initial Access
T1199 Trusted Relationship; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice
Resource Development
T1583.001 Domains; T1583.004 Server; T1583.006 Web Services; T1585.002 Email Accounts; T1608.005 Link Target
Reconnaissance
T1589.002 Email Addresses; T1591.002 Business Relationships; T1594 Search Victim-Owned Websites; T1598.003 Spearphishing Link
Impact
stealth
Affected products and versions in Nine-Year Fraud Campaign Clones Russian Company Sites to
- Russian fertilizer manufacturers — Corporate website / brand identity
Vulnerable versions: Public brand and corporate identity impersonated via lookalike/clone domains - Russian petrochemical companies — Corporate website / brand identity
Vulnerable versions: Public brand and corporate identity impersonated via lookalike/clone domains - Russian metallurgical plants — Corporate website / brand identity
Vulnerable versions: Public brand and corporate identity impersonated via lookalike/clone domains - Russian logistics operators — Corporate website / brand identity
Vulnerable versions: Public brand and corporate identity impersonated via lookalike/clone domains - Russian banking institutions — Corporate website / brand identity
Vulnerable versions: Public brand and corporate identity impersonated via lookalike/clone domains
Remediation for Nine-Year Fraud Campaign Clones Russian Company Sites to
Immediate actions
- Independently verify counterparties' contact information and banking/payment details through a channel separate from the one used to receive the commercial offer, contract, or invoice
- Cross-check the supplier's company registration and legitimacy against trusted government business registries before making any advance payment
- Verify domain registration dates and WHOIS/registration history for any new supplier website before transacting
Workarounds
- Require dual-channel confirmation (phone plus email to a previously-verified contact) of banking details before wiring any advance payment
- Use escrow or letter-of-credit payment mechanisms for first-time international B2B transactions instead of direct advance payment to a new counterparty
Longer-term hardening
- Establish a documented supplier/vendor verification process for B2B advance-payment transactions, especially with new international counterparties
- Monitor for lookalike/typosquat domains of your own brand across additional TLDs (.com/.org/.net in addition to .ru) via domain-monitoring or brand-protection services
- Train procurement, sales, and finance staff to recognize forged commercial documentation and cold-call social-engineering pretexts used in advance-fee fraud
Timeline of Nine-Year Fraud Campaign Clones Russian Company Sites to
- Earliest identified fraudulent clone domain (agrocenter-eurohem.ru, impersonating a Russian chemical/fertilizer company) registered, marking the start of the fraud operation. F6 disclosed only the year, not the exact month.
- An Azerbaijani company is defrauded of $150,000 after engaging with a cloned Russian company website and forged commercial documentation carrying fraudulent banking details. F6 disclosed only the month, not the exact day.
- F6 documents that after legitimate companies or partners posted public fraud warnings referencing the impersonating sites, the campaign operators copied those warning notices onto their own fraudulent domains but replaced the referenced domain names, redirecting victim suspicion away from the actual fraudulent site.
- F6 Cybercrime Investigation Department senior specialist Vera Kolenikova states that analysis of the recovered forged files shows the operators prepare complete business documentation packages (commercial offers, contracts, invoices) specifically to support fake transactions and build victim confidence.
- F6 technical lead Elena Shamshina states that a significant portion of the fraud infrastructure shares common DNS records, IP addresses, and domain registration data, and F6 identifies links between a subset of the infrastructure and prior fraud campaigns by the same operators.
- F6's Threat Intelligence Department completes analysis identifying nearly 100 counterfeit domains impersonating Russian fertilizer, petrochemical, metallurgical, logistics, and banking companies as part of a single coordinated fraud operation.
- F6 publishes guidance for international B2B buyers to independently verify counterparties' contact information, banking details, and domain registration/legitimacy before making advance payments to Russian exporters.
- The Hacker News publishes the first public English-language report on the nine-year fraud campaign, citing F6's findings including the two associated hosting IPs 212.127.73.235 and 167.86.100.68.
Sources cited for Nine-Year Fraud Campaign Clones Russian Company Sites to
- Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
- Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments (Instagram repost)
- Fraudsters built nearly 100 fake websites impersonating major Russian companies (Facebook repost)
- MITRE ATT&CK - T1566: Phishing
- MITRE ATT&CK - T1036: Masquerading
- MITRE ATT&CK - T1583: Acquire Infrastructure
- MITRE ATT&CK - T1657: Financial Theft
- MITRE ATT&CK - T1656: Impersonation
- MITRE ATT&CK - T1566.004: Phishing: Spearphishing Voice
Detection coverage for TL-2026-1765
As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1765 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.