Loading threat actor…
Diesel Vortex is a financially motivated cybercriminal group operating a phishing and phishing-as-a-service ecosystem focused on the freight and logistics sector. Active from at least September 2025 through February 2026, the group targeted transportation and logistics organizations in the United States and Europe, stealing more than 1,600 unique credentials from users of industry platforms such as load boards, fleet management portals, fuel card systems, and freight exchanges. The operation supported downstream fraud including account compromise, impersonation of carriers and brokers, check fraud, invoice redirection, and likely double-brokering and cargo-diversion schemes. The group built and operated a phishing platform internally referred to as GlobalProfit and marketed externally as MC Profit Always. Recovered operational artifacts indicated a structured criminal enterprise with defined roles including programmers, call-center personnel, mail-support staff, resellers, and personnel tasked with sourcing logistics-sector contacts. Diesel Vortex also infiltrated trucking and logistics Telegram communities to identify victims and support social-engineering operations. Diesel Vortex used tailored phishing templates for multiple logistics-related services and conducted interactive credential theft through Telegram-controlled workflows. Operators guided victims through staged collection of usernames, passwords, PINs, security tokens, and multi-factor authentication codes in real time. The platform also included secondary phishing modules for major email providers, enabling broader mailbox compromise after initial credential capture. Delivery and evasion tradecraft included typosquatting, iframe-based phishing pages, extensive cloaking and filtering logic, and email lures sent through legitimate third-party mail infrastructure with homoglyph-based anti-detection techniques. Voice-phishing elements were also present in recovered communications and workflow artifacts. Attribution evidence points to a Russian-linked criminal operation, with Russian-language development artifacts, infrastructure ties, and marketing on Russian-language cybercrime forums. Recovered Telegram logs also showed Armenian-language coordination, indicating an Armenian-speaking operational component. Diesel Vortex is best characterized as a Russian-linked financially motivated threat group with a specialized focus on logistics-sector credential theft and fraud enablement rather than a state-sponsored espionage actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
51 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated threat group conducting phishing campaigns against freight and logistics operators to steal credentials, supporting cyber-enabled cargo theft activity.
Credential-phishing against freight/logistics platforms to enable fraud and cargo diversion, disrupting supply chain operations across multiple countries.
Organized criminal group operating a phishing-as-a-service (PhaaS) platform purpose-built for the freight/trucking/logistics sector, used to steal credentials from major logistics platforms and enable downstream fraud (e.g., EFS check fraud and suspected double-brokering/cargo diversion).
Financially motivated credential-theft and freight fraud operation targeting freight/logistics platforms. Runs large-scale phishing/typosquatting infrastructure, uses email and voice phishing plus Telegram-based operator control to steal credentials and sensitive logistics/payment data, and supports downstream fraud including freight impersonation, mailbox compromise, and double-brokering/cargo diversion.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.