Loading story…
Cybercriminals are targeting trucking and logistics companies by deploying remote monitoring and management (RMM) tools and other malware to gain unauthorized access to corporate networks. Once inside, these actors—often working in concert with organized crime groups—leverage their access to manipulate shipment details, bid on real cargo loads, and ultimately steal physical freight. The stolen goods, which include commodities such as food, beverages, electronics, and energy drinks, are typically resold online or shipped overseas, resulting in significant financial losses and supply chain disruptions for affected companies.
Attackers employ a variety of tactics, including spear-phishing emails, social engineering, and the use of compromised email accounts to hijack legitimate business conversations. They frequently impersonate brokers or carriers, sending malicious links disguised as shipment information to lure victims into installing malware. Proofpoint has observed nearly two dozen distinct campaigns in recent months, with at least three known criminal groups involved. The campaigns exploit the urgency and trust inherent in freight negotiations, making logistics companies particularly vulnerable to these sophisticated cyber-enabled cargo theft operations.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
The FBI issued a public warning that cyber-enabled cargo theft is rapidly increasing in the U.S. transportation and logistics sector, estimating 2025 losses in the U.S. and Canada at nearly $725 million. The bureau said criminals have compromised freight brokers and carriers since at least 2024 using phishing and spoofed communications to divert shipments, and it published mitigation and reporting guidance.
Deception.pro released technical indicators tied to the cargo-theft actor’s decoy-environment intrusion, including domains, URLs, an IP address, and multiple SHA-256 hashes. The publication also included sample Gurucul TDIR detection queries, expanding defender-facing technical detail beyond earlier reporting on the intrusion workflow.
Proofpoint reported that in the load-board intrusion it investigated, attackers searched victim environments for cryptocurrency wallets, PayPal credentials, and transportation-specific tools such as load management and freight brokerage software. Researchers also said a final ScreenConnect instance included a script automating queries to an external certificate-signing service, possibly to adapt to recent ScreenConnect safeguards.
On 2026-02-27, Proofpoint observed a financially motivated actor compromise a load board platform and deliver a malicious VBS payload by email to a decoy environment that remained compromised for more than 30 days. Researchers documented persistent access via multiple RMM tools and a trust-evasion technique in which the attacker re-signed a ScreenConnect installer with a fraudulent but valid code-signing certificate hosted on attacker-controlled Amazon S3 infrastructure.
Proofpoint published research describing a cluster of cybercriminal activity in which attackers work with organized crime groups to compromise logistics firms, access freight systems, and divert or steal physical cargo. The report detailed tactics, affected sector focus, and the use of RMM tools and credential theft to deepen access.
Since August 2025, Proofpoint observed more than or nearly two dozen distinct campaigns targeting North American trucking and logistics organizations. The campaigns involved use of legitimate RMM products such as ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve to support cargo theft.
Proofpoint said the cyber-enabled cargo theft activity has been active since at least June 2025, with attackers targeting trucking and logistics companies to facilitate theft of physical shipments. The operations used phishing, email thread hijacking, compromised load boards, and remote monitoring and management tools to gain access.
Proofpoint said there are indications the cyber-enabled cargo theft activity may have begun as early as January 2025, earlier than its prior public baseline of June 2025. The cluster targeted trucking carriers, freight brokers, and logistics firms to facilitate theft of physical shipments through compromised freight operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 67 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
25 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourceic3.gov
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A financially motivated cargo-theft and freight-fraud operation has expanded to U.S. state, local, tribal, and territorial government networks through phishing emails impersonating legitimate Google Drive sharing notifications. The campaign delivers a custom PowerShell WebSocket remote-access trojan (RAT), giving operators interactive access before deploying both **ConnectWise ScreenConnect** and **Pulseway** remote monitoring and management (RMM) tools for redundant persistence. Attackers host lures and payloads in Google Cloud Storage, use Unicode homoglyphs to disguise content, and generate VBS droppers in the victim’s browser to evade security controls. CIS linked the activity to the cargo-theft campaign documented by Proofpoint through an identical Pulseway installer hash as well as overlapping infrastructure and tradecraft; observed variants include encrypted WebSocket command-and-control, UAC-bypass capabilities, and randomized payload builds, while beacons from additional government networks indicate continued expansion beyond transportation and logistics victims.
Sep 1, 2026
Multiple cybercriminal operations have been reported, each employing distinct tactics to compromise organizations and individuals. These include a large-scale business email compromise (BEC) campaign dubbed 'Scripted Sparrow,' which orchestrated a global siege involving three million emails, and a sophisticated loader attack using fake purchase orders to target manufacturing giants in Italy, Finland, and Saudi Arabia. Another campaign, referred to as 'The Payroll Trap,' leverages fake CAPTCHA pages in a quishing (QR code phishing) scheme to hijack employee paychecks. Additionally, a phishing campaign impersonating ADP was observed, where threat actors used convincing emails and counterfeit login pages to steal employee credentials and personal data. Further, the cybercriminal ecosystem is seeing notable developments, such as the unmasking of 'Fly,' the secret architect behind the infamous Russian Market, and the formation of an alliance between Qilin, DragonForce, and a declining LockBit ransomware group. These stories highlight the evolving landscape of cybercrime, with actors employing both technical deception and strategic partnerships to maximize their impact against a range of targets worldwide.
Jun 29, 2026
Cybercriminals have significantly increased the use of concealed JavaScript and steganography to deliver malware through business-themed email attacks in the third quarter of 2025. Security researchers at Forcepoint X-Labs observed a surge in malicious emails disguised as legitimate business communications, such as purchase orders, shipment notifications, and payment requests. These emails often contain compressed archive attachments (ZIP, RAR, 7z, or TAR) that include heavily obfuscated JavaScript files. The obfuscation is designed to evade detection by security tools, making it difficult for traditional email filters to identify the threat. Once a recipient opens the JavaScript file, it leverages legitimate Windows utilities like PowerShell and Windows Management Instrumentation (WMI) to execute commands, a technique known as 'Living off the Land' (LotL). This approach allows attackers to operate without raising immediate suspicion or triggering standard security alerts. A notable aspect of these campaigns is the use of steganography, where malicious code is hidden within seemingly innocuous image files. The JavaScript downloader decodes Base64-encoded DLL or EXE payloads embedded in these images, further complicating detection. Payloads identified in these attacks include well-known malware families such as Agent Tesla, Remcos RAT, DarkCloud, and FormBook, each capable of stealing sensitive information or providing remote access to compromised systems. The campaigns are highly targeted, with lures localized in multiple languages, including English and Spanish, to increase their effectiveness against non-English speaking businesses. Subject lines like “RE: Payment Swift MT103” and “DHL Shipment Notification” are commonly used to entice recipients into opening the attachments. The sophistication of these attacks, including the use of legitimate system tools and advanced concealment techniques, allows them to bypass many conventional security defenses. Security experts recommend organizations implement advanced email filtering, strengthen endpoint security, and conduct regular user awareness training to mitigate the risk. The trend highlights the evolving tactics of threat actors who continuously adapt to evade detection and maximize the impact of their campaigns. Organizations are urged to remain vigilant and update their security protocols to address these emerging threats. The use of steganography in malware delivery represents a significant challenge for defenders, as it requires more advanced analysis to uncover hidden payloads. The ongoing evolution of these attack methods underscores the importance of a multi-layered security approach. Businesses are advised to monitor for unusual activity related to PowerShell and WMI, as these are commonly abused in such attacks. The widespread nature of these campaigns suggests that organizations of all sizes and sectors are at risk. Collaboration between security vendors and enterprises is essential to develop effective countermeasures. The research underscores the need for continuous threat intelligence sharing to stay ahead of rapidly changing attack techniques. Ultimately, the rise in JavaScript and steganography-based malware delivery marks a new phase in email-borne threats, demanding heightened awareness and proactive defense strategies.
Jun 29, 2026