NEWS

Diesel Vortex: Russian Cybercrime Ring Steals 1,649

A Russian-linked phishing operation dubbed Diesel Vortex has stolen over 1,649 credentials from major freight and logistics companies across the US and...

Dylan H.

News Desk

February 25, 2026
4 min read
Diesel Vortex: Russian Cybercrime Ring Steals 1,649

Russian PhaaS Operation Targets Critical Freight Infrastructure

A sophisticated Russian-linked cybercrime group tracked as Diesel Vortex has been actively stealing credentials from freight and logistics companies across the United States and Europe since September 2025, researchers from Have I Been Squatted and Ctrl-Alt-Intel revealed on February 25, 2026. The operation — now disrupted — compromised over 1,649 unique credentials from platforms and service providers critical to global freight operations.

The campaign is notable for operating as a Phishing-as-a-Service (PhaaS) platform, marketed internally as "MC Profit Always" and branded as "GlobalProfit", with an organized structure that included a call centre, mail support, programmers, and dedicated staff responsible for identifying logistics targets.

AttributeValue
Threat GroupDiesel Vortex
OriginRussia (with Armenian infrastructure links)
Active SinceSeptember 2025
Credentials Stolen1,649 unique credentials
Phishing Domains52 typosquatting domains
Targeted Emails57,000+ unique addresses
Attack TypePhishing-as-a-Service (PhaaS)
StatusDisrupted (February 2026)

How the Campaign Worked

Diesel Vortex deployed 52 typosquatting phishing domains mimicking legitimate freight platforms, targeting employees at major companies including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source (EFS). Over the five-month campaign, the group sent phishing emails to over 57,000 unique addresses harvested from logistics industry sources.

The operation went well beyond simple credential theft. Evidence uncovered by researchers revealed coordinated activities related to:

Credential Harvesting

Victims were directed to convincing clones of freight platform login pages. Once credentials were captured, they were processed through the "GlobalProfit" backend panel, which organized stolen credentials by platform and account value.

Freight Fraud Operations

With access to freight operator accounts, the group engaged in double-brokering (listing loads already booked by legitimate brokers), cargo diversion, mailbox compromise, and freight impersonation to redirect physical shipments.

Scaling Through PhaaS

The "MC Profit Always" platform was being actively marketed to other criminal operators, suggesting the group was moving toward franchising its operation across the cybercrime ecosystem.

Impact AreaDescription
Credential Exposure1,649 accounts across major freight platforms
Financial FraudDouble-brokering and cargo diversion schemes
Infrastructure52 phishing domains, GitLab repositories
Industry RiskCritical supply chain disruption potential

Recommendations

For Freight and Logistics Operators

  1. Enforce multi-factor authentication (MFA) on all freight platform accounts immediately
  2. Conduct domain monitoring for typosquatting variants of your company and partner names
  3. Train staff to verify login URLs before entering credentials — bookmark official portals
  4. Review all recent logins on platforms such as DAT Truckstop, TIMOCOM, and Teleroute for anomalies

For Security Teams

  1. Block the 52 known Diesel Vortex phishing domains (check Have I Been Squatted and Ctrl-Alt-Intel for IoCs)
  2. Search SIEM logs for outbound connections to GlobalProfit infrastructure
  3. Alert on any authentication from logistics accounts outside normal business hours or geolocations

Key Takeaways

  1. Diesel Vortex operated as PhaaS, meaning its tools and infrastructure were available for sale to other criminals — disruption of the primary group doesn't eliminate the threat.
  2. 1,649 credentials stolen over five months with 57,000 targeted emails shows the scale of organized freight-sector cybercrime.
  3. The operation was disrupted through coordinated action by GitLab, Cloudflare, Google Threat Intelligence, CrowdStrike, and Microsoft Threat Intelligence Center.
  4. No software vulnerabilities were exploited — this campaign succeeded entirely through social engineering and credential reuse.
  5. Double-brokering and cargo diversion represent a direct physical-world consequence of digital credential theft in the logistics sector.
  6. Logistics operators are increasingly high-value targets because compromised accounts enable real-world financial fraud beyond typical data theft.

Sources