A financially motivated threat group known as Diesel Vortex is currently targeting freight and logistics organizations across the U.S. and Europe in a sophisticated phishing campaign. Active since late 2024, the group has compromised critical platforms to facilitate cargo theft and financial fraud.

Key Campaign Details

• Targets: Major industry players including DAT Truckstop, TIMOCOM, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source (EFS).
• Impact: Researchers at Have I Been Squatted and Ctrl-Alt-Intel have identified over 1,600 unique stolen credentials harvested from more than 57,000 targeted email addresses.
• Origin: The actors are believed to be Armenian-speaking individuals connected to Russian infrastructure, operating with a highly organized, call-center-like structure.

Attack Tactics

• Typosquatting & Cloaking: The group deployed dozens of phishing domains using Cyrillic homoglyphs and a 9-stage cloaking process to bypass security filters.
• Phishing-as-a-Service: The operation utilized a custom phishing kit marketed as “MC Profit Always” (likely referring to Motor Carriers) or “Global Profit”.
• Multi-Channel Social Engineering: Attacks combine spearphishing via email, voice phishing(vishing), and infiltration of logistics-focused Telegram channels to intercept MFA codes.
• Post-Compromise Exploitation: Stolen access is used for “double brokering” (intercepting and reassigning loads to fraudulent points) and committing fuel card fraud.