Affected Systems

International businesses conducting B2B trade with Russian fertilizer manufacturers, petrochemical companies, metallurgical plants, logistics operators, and banks. Primary targets: CIS countries and international importers. Campaign active since 2017, with ~100 counterfeit domains identified. Key malicious infrastructure: IP 212.127.73[.]235 and 167.86.100[.]68.

Exploitation Status

Active campaign ongoing since 2017. Recent victim (Azerbaijani company) lost $150,000 in April 2025. Threat actors actively adapting tactics, including copying fraud warnings from legitimate sites onto cloned domains. No technical exploit involved—relies on social engineering and brand impersonation.

Business Impact

Financial fraud targeting advance payments for non-existent goods. Victims lose funds (documented case: $150k), while impersonated companies suffer reputational damage. Attack chain uses cold calls, phishing emails, and lookalike domains (.ru, .com, .org, .net) in multiple languages (Russian, English, Arabic, French). Fraudsters provide complete fake documentation (contracts, invoices, commercial offers) with altered bank details. Some operations involve hiring legitimate sales reps who unknowingly funnel victims to attackers.

Urgency

🟡 Within a week

Recommended Actions

  • Block known malicious IPs 212.127.73[.]235 and 167.86.100[.]68 at perimeter firewalls and web proxies
  • Implement mandatory out-of-band verification for all new supplier payment details—use known phone numbers from government registries, not contact info from emails or websites
  • Train procurement and finance teams to verify domain registration dates via WHOIS for new suppliers (domains registered recently are red flags for established companies)
  • Cross-reference supplier contact information against official government business registries (e.g., Russian EGRUL) before initiating payments
  • Flag and review any supplier communications that redirect to alternate bank accounts or introduce 'subsidiary' entities mid-transaction

---

# Geopolitical Context

Geopolitical Context

This campaign represents a sophisticated, financially motivated cybercrime operation exploiting Russia's position in global commodity supply chains. Since 2017, threat actors have systematically cloned websites of Russian fertilizer manufacturers, petrochemical firms, and metallurgical plants to intercept advance payments from international buyers. The operation's longevity and scale—spanning nearly 100 counterfeit domains across multiple languages (Russian, English, Arabic, French)—indicates a well-resourced criminal enterprise capitalizing on the complexity of B2B international trade. The targeting of CIS-region businesses and the use of .ru domains in early iterations, followed by migration to generic TLDs (.com, .org, .net), suggests adaptation to evolving detection capabilities and potentially shifting geopolitical conditions affecting Russia's trade relationships. The campaign inflicts dual harm: direct financial losses to international buyers (including a documented $150,000 loss by an Azerbaijani firm in 2025) and reputational damage to legitimate Russian enterprises already operating under constrained international market conditions.

State Actor Alignment

No evidence links this activity to state-sponsored operations. The campaign appears consistent with financially motivated cybercrime, employing classic advance-fee fraud techniques adapted for the B2B sector. The threat actors demonstrate criminal entrepreneurship rather than strategic intelligence objectives—their goal is payment diversion, not espionage or disruption. Russian cybersecurity firm F6's public disclosure and investigation suggests domestic law enforcement interest, though no arrests or attributions have been reported. The operation's persistence since 2017 may indicate limited enforcement action, which could reflect jurisdictional challenges in prosecuting crimes where victims are predominantly outside Russia, resource constraints within Russian cybercrime units, or the low prioritization of cases where Russian entities are impersonated rather than directly victimized. The campaign does not appear connected to sanctions evasion schemes or state efforts to circumvent trade restrictions.

Business Impacty pro region

The campaign's primary impact falls on international businesses engaged in commodity trade with Russia, particularly in the CIS region, Middle East (Arabic-language sites), and Francophone markets (French-language sites). For European firms sourcing fertilizers and petrochemicals—sectors where Russia maintains significant global market share despite sanctions—the operation introduces additional due diligence burdens and transaction risk. The fraud exacerbates existing trust deficits in Russia-linked trade relationships, potentially accelerating supply chain diversification away from Russian suppliers as buyers seek lower-risk alternatives. CIS countries, which maintain closer economic integration with Russia, face disproportionate exposure given their continued reliance on Russian industrial goods and the attackers' demonstrated focus on this region. The campaign also highlights vulnerabilities in international B2B payment systems, where advance payment models remain common in commodity sectors but lack robust verification mechanisms. Reputational damage to legitimate Russian companies may compound commercial challenges these firms already face in international markets, further isolating Russia's industrial sector from global trade networks.

Forecast

If the threat actors continue their demonstrated pattern of operational adaptation—migrating to new TLDs, expanding language support, and rapidly replicating fraud warnings—the campaign is likely to persist absent coordinated international law enforcement action. The criminals' ability to sustain operations for nine years suggests effective monetization and low interdiction risk. If geopolitical tensions continue to complicate Russia's trade relationships, the attackers may find expanded opportunities as legitimate Russian companies establish new subsidiaries or alter business structures to navigate sanctions, creating additional confusion that fraudsters can exploit. Conversely, if international buyers increasingly implement rigorous supplier verification protocols in response to this and similar fraud schemes, the campaign's success rate may decline, potentially forcing threat actors to shift tactics or target less sophisticated victims. If Russian authorities prioritize investigation—particularly given domestic companies' reputational harm—disruption of the infrastructure (concentrated on two primary IP addresses) could significantly degrade operations, though attribution and prosecution of individuals behind the scheme would likely require international cooperation that current geopolitical conditions may not support.