Researchers link nearly 100 cloned corporate websites to a nine-year B2B fraud operation

F6's Threat Intelligence and Cybercrime Investigation Departments have documented what appears to be a long-running B2B fraud campaign built around cloned corporate websites.

According to the report, the operation has been active for more than nine years and involved nearly 100 fraudulent domains impersonating companies across the chemical, metallurgical, petrochemical, food, logistics, and financial sectors. The cloned sites copied legitimate company content while replacing contact information and payment details with those controlled by the attackers.

Researchers say the fraud extended well beyond fake websites. The operators reportedly used cold calls, phishing emails, forged contracts, invoices, and corporate-looking email addresses to convince organizations they were dealing with legitimate suppliers. In one case cited in the report, an Azerbaijani company reportedly lost approximately $150,000 in a single fraudulent transaction.

One particularly interesting finding is that after legitimate companies published fraud warnings, the attackers copied those warnings onto their own fake websites and simply replaced references to the genuine domains with the fraudulent ones.

The report reinforces a practical lesson for procurement and security teams: independently verify supplier domains, registration history, contact details, and payment instructions before transferring funds, especially during cross-border transactions.

Complete article and investigation: https://www.technadu.com/nine-years-nearly-100-fake-websites-inside-a-long-running-scheme-to-clone-russian-companies/632266/