Diesel Vortex
Diesel Vortex is a financially motivated criminal threat group and phishing-as-a-service (PhaaS) operator identified in February 2026 by Have I Been Squatted and Ctrl-Alt-Intel/Ctrl-Alt-Int3l. The group targeted freight and logistics organizations in the United States and Europe, with reporting specifically citing the US, Germany, France, and Lithuania. The confirmed campaign ran from at least September 2025 through February 2026 and used 52 phishing domains to steal more than 1,600 unique credentials from users of logistics platforms including DAT Truckstop, Penske Logistics, Electronic Funds Source (EFS), TIMOCOM, Teleroute, Highway, Central Dispatch, and Girteka-related workflows. The operation used a phishing platform internally named "GlobalProfit" and marketed externally as "MC Profit Always." Reporting describes dedicated phishing infrastructure for load boards, fleet management portals, fuel card systems, and freight exchanges. The platform used a dual-domain iframe architecture, pixel-level cloned login pages, and a nine-stage cloaking process. Operators controlled victim interactions in real time through Telegram bots and webhook-driven workflows, including prompting for passwords, MFA codes, PINs, security tokens, and secondary email-provider credentials for Google, Microsoft, and Yahoo. The activity also included vishing, infiltration of trucking and logistics Telegram communities, and phishing emails sent via Zoho SMTP and Zeptomail using Cyrillic homoglyph evasion. Recovered data also showed EFS-focused check-fraud workflows and 35 attempted check-fraud cases. Recovered repository, SQL, and Telegram data described a structured criminal enterprise with roles including call-center staff, mail support, programmers, resellers, and contact-finding personnel. Researchers reported evidence of Russian-language development, Russian-language cybercrime forum sales, and Russian-linked infrastructure or corporate correlations, and assessed the actor as Russian-linked/Russian-speaking. Telegram webhook logs also showed Armenian-language coordination, indicating an Armenian-speaking operational component. The reporting does not support high-confidence nation-state attribution; Diesel Vortex is described as a criminal, financially motivated group. Known alias/designations directly mentioned in the content are Diesel Vortex, with the associated platform names GlobalProfit and MC Profit Always.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Transportation
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
51 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated threat group conducting phishing campaigns against freight and logistics operators to steal credentials, supporting cyber-enabled cargo theft activity.
Credential-phishing against freight/logistics platforms to enable fraud and cargo diversion, disrupting supply chain operations across multiple countries.
Organized criminal group operating a phishing-as-a-service (PhaaS) platform purpose-built for the freight/trucking/logistics sector, used to steal credentials from major logistics platforms and enable downstream fraud (e.g., EFS check fraud and suspected double-brokering/cargo diversion).
Financially motivated credential-theft and freight fraud operation targeting freight/logistics platforms. Runs large-scale phishing/typosquatting infrastructure, uses email and voice phishing plus Telegram-based operator control to steal credentials and sensitive logistics/payment data, and supports downstream fraud including freight impersonation, mailbox compromise, and double-brokering/cargo diversion.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.