Dangerous actors are more and more coaching their sights on trucking and logistics firms with an goal to contaminate them with distant monitoring and administration (RMM) software program for monetary acquire and in the end steal cargo freight.
The risk cluster, believed to be lively since a minimum of June 2025 in keeping with Proofpoint, is claimed to be collaborating with organized crime teams to interrupt into entities within the floor transportation business with the top objective of plundering bodily items. Probably the most focused commodities of the cyber-enabled heists are meals and beverage merchandise.
“The stolen cargo more than likely is bought on-line or shipped abroad,” researchers Ole Villadsen and Selena Larson stated in a report shared with The Hacker Information. “Within the noticed campaigns, risk actors goal to infiltrate firms and use their fraudulent entry to bid on actual shipments of products to in the end steal them.”
The campaigns share similarities with a earlier set of assaults disclosed in September 2024 that concerned focusing on transportation and logistics firms in North America with info stealers and distant entry trojans (RATs) corresponding to Lumma Stealer, StealC, or NetSupport RAT. Nonetheless, there isn’t a proof to recommend that they’re the work of the identical risk actor.
Within the present intrusion wave detected by Proofpoint, the unknown attackers have leveraged a number of strategies, together with compromised e mail accounts to hijack current conversations, focusing on asset-based carriers, freight brokerage corporations, and built-in provide chain suppliers with spear-phishing emails, and posting fraudulent freight listings utilizing hacked accounts on load boards.
“The actor posts fraudulent freight listings utilizing compromised accounts on load boards after which sends emails containing malicious URLs to carriers who inquire concerning the hundreds,” it stated. “This tactic exploits the belief and urgency inherent in freight negotiations.”
For sure, the malicious URLs embedded inside the messages result in booby-trapped MSI installers or executables that deploy legit RMM instruments like ScreenConnect, SimpleHelp, PDQ Join, Fleetdeck, N-able, and LogMeIn Resolve. In choose cases, a number of of those packages are used collectively, with PDQ Join getting used to drop and set up ScreenConnect and SimpleHelp.
As soon as distant entry is obtained, the attackers transfer to conduct system and community reconnaissance, adopted by dropping credential harvesting instruments corresponding to WebBrowserPassView to seize extra credentials and burrow deeper into the company community.
In a minimum of one case, the risk actor is believed to have weaponized the entry to delete current bookings and block dispatcher notifications, after which added their very own gadget to the dispatcher’s cellphone extension, booked hundreds beneath the compromised service’s identify, and coordinated the transport.
Using RMM software program presents a number of benefits. First, it obviates the necessity for risk actors to plot bespoke malware. Second, it additionally permits them to fly beneath the radar, owing to the prevalence of such instruments in enterprise environments, and are sometimes not flagged as malicious by safety options.
“It is pretty straightforward for risk actors to create and distribute attacker-owned distant monitoring instruments, and since they’re typically used as legit items of software program, finish customers could be much less suspicious of putting in RMMs than different distant entry trojans,” Proofpoint famous again in March 2025. “Moreover, such tooling might evade anti-virus or community detection as a result of the installers are sometimes signed, legit payloads distributed maliciously.”
