As reported by The Hacker News, security researchers at Russian cybersecurity vendor F6 have detailed a remarkably persistent fraud campaign that has operated for at least nine years, systematically cloning the web presence of major Russian industrial companies — including fertilizer manufacturers and petrochemical firms — to deceive international buyers into wiring advance payments to attacker-controlled accounts.
Why This Campaign Deserves Serious Attention
Nine years is an extraordinary operational lifespan for any fraud campaign. Most financially motivated threat operations are disrupted within months, either by law enforcement, takedowns, or victim attrition. The longevity here suggests a well-resourced, disciplined operation with robust infrastructure rotation, careful target selection, and likely limited exposure due to the cross-border nature of the victims — international firms purchasing Russian commodities who may lack the local knowledge or relationships to easily verify supplier authenticity.
This is not opportunistic phishing. The attackers specifically targeted the B2B procurement process — a space where large advance payments are culturally and contractually normal, particularly in commodities trading. Fertilizer and petrochemical contracts routinely involve six- and seven-figure wire transfers before goods ship. That makes every successful deception extraordinarily lucrative.
The Anatomy of Industrial Clone-Site Fraud
What makes this campaign structurally dangerous is that it exploits legitimate business processes rather than technical vulnerabilities. There is no malware to detect, no CVE to patch. The attack chain is fundamentally social and procedural:
The attackers aren't breaking into systems — they're breaking into procurement workflows. That's a fundamentally different threat model that most security tools are not designed to detect.
Who Is Most at Risk
The exposure here extends well beyond firms sourcing from Russia. The same playbook applies to any cross-border commodity or industrial procurement relationship where:
- Advance payment or deposit terms are standard practice
- Buyers have limited direct relationships with supplier staff
- Procurement is managed through intermediaries or trading desks
- Email is the primary contract and invoice channel
- Supplier verification relies primarily on website review and document exchange
Agricultural importers, energy traders, chemical distributors, and heavy manufacturing procurement teams globally should treat this campaign as a template threat — not a Russia-specific anomaly.
Broader Implications for Supply Chain Security
This campaign is a stark reminder that Business Email Compromise (BEC) and its web-clone variants remain among the highest-ROI attack categories for financially motivated threat actors. The FBI's IC3 consistently reports BEC as the top category by dollar losses, and this operation represents an industrialized, long-duration variant of that threat applied to commodity supply chains.
The geopolitical dimension also matters. Sanctions regimes, banking restrictions, and the reduced due diligence infrastructure for Russia-linked trade since 2022 have likely made verification even harder for international buyers — potentially expanding the attacker's effective target pool.
Shield53 Recommendations
For Procurement and Finance Teams
- Implement out-of-band payment verification: Any wire transfer instruction — whether first contact or a change to existing banking details — must be confirmed via a independently verified phone number, not contact information from the email or website that delivered the instruction.
- Verify domains before trusting web content: Check domain registration age (WHOIS), look for subtle typosquats, and cross-reference against known supplier contact lists held internally.
- Establish supplier relationship protocols: Maintain a verified contact directory for key suppliers, confirmed through multiple channels at contract initiation — not during an active transaction.
- Require dual authorization for large wire transfers: No single individual should be able to authorize a significant advance payment without independent corroboration of supplier details.
For Security Teams
- Monitor for lookalike domains: Deploy domain monitoring services (e.g., through threat intelligence feeds or tools like DomainTools, Recorded Future) for your own brand and for key suppliers where possible.
- Train procurement staff specifically on BEC and clone-site fraud: General phishing awareness training is insufficient — procurement personnel need scenario-specific education around payment redirection fraud.
- Integrate fraud indicators into threat intelligence programs: Share IOCs (lookalike domains, fraud infrastructure) with industry peers and ISACs relevant to your sector.
- Audit your supplier onboarding process: Assess whether your current vendor verification workflow would catch a well-constructed clone site. If the answer is uncertain, it needs improvement.
The nine-year duration of this campaign is not a story about sophisticated attackers — it's a story about persistent gaps in procurement security hygiene. The fix is largely procedural, not technological, which means it is achievable for organizations of any size willing to prioritize it.
