Diesel Vortex: Russian Cybercrime Group Targets US and EU Freight Companies

• •Diesel Vortex targeted US and EU logistics firms, stealing over 1,600 credentials.
• •The group used phishing-as-a-service tactics, including impersonation and double-brokering.
• •Collaboration among cybersecurity firms led to the exposure and takedown of the group's infrastructure.

In February 2026, the cybercrime group Diesel Vortex was uncovered, targeting freight and logistics companies in the US and EU. The group employed phishing-as-a-service tactics, harvesting over 1,600 unique login credentials from major logistics platforms. Their operations included impersonation of legitimate carriers and brokers, utilizing sophisticated spearphishing and voice phishing techniques. Internal logs revealed coordination among Armenian-speaking operators, indicating a complex network behind the attacks. The group also engaged in double-brokering, redirecting freight under stolen identities. Investigators from Have I Been Squatted and Ctrl-Alt-Intel collaborated to analyze the group's infrastructure, leading to the exposure of their codebase and operational plans. The operation is assessed to have been active from September 2025 to February 2026, with ongoing investigations into earlier activities. The takedown of their infrastructure involved multiple cybersecurity firms and organizations.