Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments

Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian companies with an aim to siphon funds from international firms for more than nine years. According to Russian cybersecurity vendor F6, the threat actors have set up clone websites of Russian companies across fertilizer manufacturers, petrochemical companies

The article describes a long-running fraud campaign in which threat actors create cloned websites of major Russian companies across sectors such as fertilizer, petrochemicals, logistics, and banking to trick international B2B buyers into sending advance payments for non-existent goods.[1][2] Researchers report nearly 100 counterfeit domains, using lookalike domains, copied site content, and multilingual pages to target victims via cold calls, phishing emails, and fraudulent corporate websites.[1][3] From a RealGround perspective, while this specific campaign is not explicitly described as using AI, it illustrates a mature business-impersonation and web-cloning tradecraft that is increasingly being augmented by generative AI in similar scams, including large-scale cloned-law-firm scams and disinformation operations.[6][8][12] Organizations deploying AI agents for B2B workflows should treat lookalike-domain and business-impersonation campaigns as a critical threat scenario, and use Continuous AI Red Teaming to test whether their AI systems can be tricked into trusting or transacting with cloned entities, as well as to strengthen verification, domain-intelligence, and payment-validati