Wolfgang Lehmacher tells readers about a hacking group called Diesel Vortex.
A little-known cyber group dubbed Diesel Vortex shows how freight fraud is becoming a repeatable service. Researchers describe a Russian-speaking operation that stole more than 1,600 logins to logistics platforms. The group turned carrier and broker identities, once back-office details, into an attack surface for trade. Unless regulators and industry leaders treat freight identity and information sharing as critical infrastructure, the criminal services market will continue to significantly outpace the sector’s defences.
Diesel Vortex is the name security specialists use for the cybercrime group. The group harvested logins for load boards, fleet portals, and fuel-card systems by luring dispatchers and brokers onto convincing fake sites they use daily. Victims included users of major platforms such as DAT Truckstop, Timocom, Teleroute, Penske Logistics, Girteka, and Electronic Funds Source (EFS). This shows the campaign targeted core infrastructure, not fringe tools. When victims entered usernames, passwords, and one-time codes, Diesel Vortex captured the details in real time and used them to access genuine platforms, accept loads, redirect cargo, and execute double-brokering scams.
No reliable loss figures for Diesel Vortex have been published, but the financial impact is likely to be material, given the scale and types of fraud.
Behind the scenes, investigators found an exposed code repository and database holding source code, victim lists, operator chat logs, and a growth plan named “GlobalProfit” and “MC Profit Always.” Investigators report that Diesel Vortex operated like a small service provider, with call-centre agents, email operators, programmers, and staff seeking carriers and drivers. All followed a reusable playbook.
This is as much a governance as a technical challenge. In North America, freight fraud from double brokering and identity fraud is rising, even as brokers and platforms invest in monitoring and rule-based controls. In Europe, key transport and logistics segments now fall under the revised NIS2 Directive, the EU’s updated cybersecurity law for essential sectors. Yet, the implementation of supply chain cyber-risk management remains uneven.
Freight fraud is organising into a franchisable supply chain of its own. Diesel Vortex looks like an early template for a portable fraud supply chain. The same tools that reportedly targeted US and European truckload platforms can, with modest adjustments, be applied to less-than-truckload (LTL) operations, warehousing, hinterland logistics, or regional marketplaces elsewhere. For ocean shipping, risk does not stop at the quay. Compromised inland identities can redirect containers, misroute cargo and weaken the trust on which liner schedules and port operations depend.
The remedy is increasingly spelled out, but the time to implement it is now. Verify all parties in every freight transaction. Mandate carrier and broker identity systems as the digital backbone of trade. Set minimum expectations for verification, monitoring, and auditability. Establish logistics-focused information-sharing and incident-response arrangements so warning signs from one attack rapidly become defences market-wide. Align economic incentives: clarify liability, promote insurance products that reward reductions in fraud losses, and prioritise platforms with verifiable controls. Take these steps now to ensure that strong identity and fraud controls become the industry standard.
Diesel Vortex’s current infrastructure has been disrupted, and the confirmed campaign window is described as closed, but investigators do not rule out future or related activity.
Ports and ships may be hard targets, but the hinterland is wide open. The industry must urgently harden the identities that move freight; otherwise, the breach will soon be in its own address book, not at sea.
