The Diesel Vortex group, a financially motivated threat actor, has been targeting freight and logistics operators in the U.S. and Europe using phishing attacks across fifty-two (52) domains since September 2025. This campaign resulted in the theft of 1,649 unique credentials from key industry platforms such as DAT Truckstop and Penske Logistics. The group’s phishing infrastructure was designed to mimic logistics platforms, capturing sensitive data like credentials, PINs, and two-factor authentication codes. They employed techniques like voice phishing (vishing) and Telegram channel infiltration, using Cyrillic homoglyphs to evade security filters. Researchers from Have I Been Squatted uncovered the operation through an exposed repository containing a phishing project database and Telegram logs. Analysis revealed that Diesel Vortex, likely Armenian speaking with Russian ties, operated a sophisticated criminal enterprise complete with a call center and mail support. The operation involved freight impersonation, mailbox compromise, and double-brokering, where stolen carrier identities were used to divert cargo. The infrastructure supporting Diesel Vortex was dismantled following a coordinated effort by GitLab, Cloudflare, Google Threat Intelligence Group, and others. The operation’s ties to Russian companies were established through domain registration data and corporate filings. The campaign highlights the growing threat of cargo theft increasing in the digital logistics sector, with estimated annual losses around $35 billion. The U.S. is responding with legislative measures like the “Combatting Organized Retail Crime Act of 2025” to address cargo theft and related crimes.