Loading story…
Two coordinated cargo thefts in California targeted semitruck shipments carrying high-value AI data center hardware from Silicon Valley to Southern California, with attackers deliberately disabling private security escort vehicles before the trucks vanished with millions of dollars in equipment. Investigators said the tactics included staged vehicle attacks such as rear-ending and PIT-style maneuvers, and they suspect the truck drivers may have been complicit; no injuries were reported.
The hijackings reflect a broader surge in cargo crime focused on enterprise computing, networking gear, and other AI infrastructure components as data center spending accelerates. Security sources said the stolen hardware is attractive to black-market buyers, with some investigators believing shipments are moved overseas, including to China, where U.S. export controls have helped push prices for advanced AI equipment far above domestic retail levels.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Investigators reported one recovery this summer of $550,000 in Celestica-built server switches destined for Meta and another of about $1 million in data center equipment found in a trailer outside Chicago. These recoveries were cited as examples of the broader targeting of enterprise and AI infrastructure cargo.
Following the suspected attacks, U.S. escort operators began reviewing stronger security measures for high-value technology shipments. Personnel were being encouraged to call 911 at the first sign of suspicion.
Verisk CargoNet reported 677 supply-chain theft incidents across the U.S. and Canada in Q2 2026, while losses rose year over year from $135.7 million to $304.6 million and the average reported theft reached $564,009. The firm also identified enterprise computing and networking equipment as a heavily targeted category.
Investigators came to suspect the truck drivers were complicit in both thefts. They also found both incidents involved motor carrier numbers that had recently changed hands, a fraud method used to book freight under a legitimate company's federal registration.
In recent months, two semitruck shipments carrying millions of dollars in AI data center hardware from Silicon Valley to Southern California were stolen after their private security escort vehicles were deliberately disabled. In one case the escort was rear-ended in a hit-and-run, and in the other it was forced into a tailspin with a PIT-style maneuver; the trucks then continued on and disappeared.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A financially motivated lone attacker used AI-assisted workflows to breach a large **AWS** environment in roughly 72 hours, according to a Sygnia incident-response report, chaining weaknesses across Internet-facing applications, AWS resources, source code repositories, **CI/CD** pipelines, runtime components, and data stores. The intrusion reportedly began with the theft of an AWS access key and expanded through secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, database access, and operational disruption. To extort the unnamed global enterprise, the actor carried out mostly reversible actions including denying access to **S3** buckets, scaling **ECS** services to zero, blocking network access with ACL rules, and purging **SQS** queues. The incident reflects a broader shift from isolated malicious use of generative AI to **agentic AI** supporting larger portions of the attack chain. Research cited by OALABS and observations from Anthropic indicate attackers are using tools such as **Claude** and **OpenAI Codex** to automate reconnaissance, analyze stolen data, generate code, and adapt operations during live intrusions, lowering the barrier for less-skilled actors while helping experienced operators scale activity. Security researchers said the trend now spans multiple **MITRE ATT&CK** tactics, including reconnaissance, credential theft, malware development, and social engineering, pushing defenders to prioritize detection of AI-enabled workflows, stronger identity controls, broader visibility, and faster automated containment.
Jul 9, 2026
CrowdStrike reported that AI has become both an offensive enabler and a direct target in cyberattacks, with AI-enabled malicious activity rising **89%** over the past year and generating more than twice as much potentially malicious detection noise as human-triggered activity. The company said attackers are using frontier models to identify vulnerabilities, generate scripts and payloads, automate intrusion workflows, and troubleshoot operations, while also pursuing attacks such as **LLMjacking**, AI cost-harvesting, and compromises of AI infrastructure and agentic systems. The findings align with earlier disclosures from OpenAI, which said it banned accounts tied to publicly reported **China-linked** actors including **Vixen** and **Keyhole Panda**, as well as suspected **DPRK-affiliated** operators, for using AI to support vulnerability research, scripting, phishing, malware research, translation, and cryptocurrency-focused targeting. The report warns that AI is sharply compressing defender response time, with **88%** of vulnerabilities reportedly weaponized within **48 hours**, reducing effective patch windows to roughly **24 to 48 hours**. CrowdStrike highlighted rapid post-disclosure exploitation by China-linked groups including **Vault Panda** and **Genesis Panda**, and described advanced AI-enabled tradecraft by North Korean actors such as **Famous Chollima**, including fake companies, AI-generated infrastructure, and trojanized repositories aimed at cryptocurrency, blockchain, and AI-focused development environments. It also cited expanding supply-chain risk, including **TeamPCP’s** compromise of more than **300** software dependencies in a single day and financially motivated activity such as **Altered Spider** stealing credentials and pivoting into cloud environments, underscoring how AI tools and integrations are widening an under-defended attack surface.
Aug 11, 2026
A broad set of cyber incidents affected critical infrastructure, consumer platforms, public institutions, and emerging AI services. The most disruptive case cited was a ransomware attack that crippled the largest gas pipeline in the United States, while other breaches exposed user data at firms including **Upstox**, **IIMJobs**, and the **World Anti-Doping Agency**. In another case, an exposed **Moltbook** database reportedly allowed anyone to take control of any AI agent on the site, highlighting how insecure backend systems can turn application flaws into full account or service compromise. The references also describe politically motivated and opportunistic attacks alongside evolving malware activity. Hackers reportedly defaced airport screens in Iran with anti-government messages, and **Anonymous**-linked hacktivists leaked **1TB** of data from a Russian law firm. Separately, a new **Mirai** variant, `Murdoc_Botnet`, was reported exploiting IoT devices to build a botnet for **DDoS** attacks, while Hong Kong moved to revive privacy legislation that would require companies to report data breaches, reflecting regulatory pressure created by the steady drumbeat of intrusions and leaks.
Jul 12, 2026