Diesel Vortex: Russian Cybercrime Ring Steals 1,649

Russian PhaaS Operation Targets Critical Freight Infrastructure

A sophisticated Russian-linked cybercrime group tracked as Diesel Vortex has been actively stealing credentials from freight and logistics companies across the United States and Europe since September 2025, researchers from Have I Been Squatted and Ctrl-Alt-Intel revealed on February 25, 2026. The operation — now disrupted — compromised over 1,649 unique credentials from platforms and service providers critical to global freight operations.

The campaign is notable for operating as a Phishing-as-a-Service (PhaaS) platform, marketed internally as "MC Profit Always" and branded as "GlobalProfit", with an organized structure that included a call centre, mail support, programmers, and dedicated staff responsible for identifying logistics targets.

How the Campaign Worked

Diesel Vortex deployed 52 typosquatting phishing domains mimicking legitimate freight platforms, targeting employees at major companies including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source (EFS). Over the five-month campaign, the group sent phishing emails to over 57,000 unique addresses harvested from logistics industry sources.

The operation went well beyond simple credential theft. Evidence uncovered by researchers revealed coordinated activities related to:

Credential Harvesting

Victims were directed to convincing clones of freight platform login pages. Once credentials were captured, they were processed through the "GlobalProfit" backend panel, which organized stolen credentials by platform and account value.

Freight Fraud Operations

With access to freight operator accounts, the group engaged in double-brokering (listing loads already booked by legitimate brokers), cargo diversion, mailbox compromise, and freight impersonation to redirect physical shipments.

Scaling Through PhaaS

The "MC Profit Always" platform was being actively marketed to other criminal operators, suggesting the group was moving toward franchising its operation across the cybercrime ecosystem.

Recommendations

For Freight and Logistics Operators

1. Enforce multi-factor authentication (MFA) on all freight platform accounts immediately
2. Conduct domain monitoring for typosquatting variants of your company and partner names
3. Train staff to verify login URLs before entering credentials — bookmark official portals
4. Review all recent logins on platforms such as DAT Truckstop, TIMOCOM, and Teleroute for anomalies

For Security Teams

1. Block the 52 known Diesel Vortex phishing domains (check Have I Been Squatted and Ctrl-Alt-Intel for IoCs)
2. Search SIEM logs for outbound connections to GlobalProfit infrastructure
3. Alert on any authentication from logistics accounts outside normal business hours or geolocations

Key Takeaways

1. Diesel Vortex operated as PhaaS, meaning its tools and infrastructure were available for sale to other criminals — disruption of the primary group doesn't eliminate the threat.
2. 1,649 credentials stolen over five months with 57,000 targeted emails shows the scale of organized freight-sector cybercrime.
3. The operation was disrupted through coordinated action by GitLab, Cloudflare, Google Threat Intelligence, CrowdStrike, and Microsoft Threat Intelligence Center.
4. No software vulnerabilities were exploited — this campaign succeeded entirely through social engineering and credential reuse.
5. Double-brokering and cargo diversion represent a direct physical-world consequence of digital credential theft in the logistics sector.
6. Logistics operators are increasingly high-value targets because compromised accounts enable real-world financial fraud beyond typical data theft.

Sources

• Diesel Vortex: Inside the Russian cybercrime group targeting US & EU freight — Have I Been Squatted
• Diesel Vortex Russian Cybercrime Group Targets Global Logistics Sector — CybersecurityNews
• Phishing operation with links to Russia, Armenia compromised Western cargo companies — The Record
• BleepingComputer: Phishing campaign targets freight and logistics orgs in the US, Europe