Threat Actors Leverage RMM Tools to Hack Trucking Companies and Steal Cargo Freight

Cybercriminals have shifted their focus to a highly profitable target: the trucking and logistics industry.

Over the past several months, a coordinated threat cluster has been actively compromising freight companies through deliberate attack chains designed to facilitate multi-million-dollar cargo theft operations.

The emergence of this campaign represents a disturbing intersection of physical crime and digital exploitation, where cyber capabilities enable the theft of real goods ranging from electronics to energy beverages.

The targeting strategy employed by these threat actors demonstrates sophisticated understanding of supply chain operations.

Rather than attacking specific companies, the criminals operate opportunistically, intercepting communications and compromising accounts across the transportation sector.

Their primary objective involves gaining unauthorized access to carrier systems, which enables them to bid on legitimate shipments and orchestrate their interception and resale on underground markets or through international channels.

Proofpoint researchers identified this threat cluster after detecting a significant uptick in campaigns beginning as early as January 2025, with intensified activity accelerating through mid-2025.

The threat actors deploy multiple remote monitoring and management tools including ScreenConnect, SimpleHelp, PDQ Connect, and N-able, frequently using multiple RMM solutions in combination to establish persistent access and conduct thorough system reconnaissance.

Infection mechanism

The infection mechanism primarily relies on social engineering tactics that exploit the inherent trust and urgency present in freight industry communications.

Attackers compromise load board accounts—online marketplaces facilitating cargo shipment bookings—then post fraudulent listings and deploy malicious URLs when carriers express interest.

Upon execution, the embedded executables grant adversaries complete system control, allowing them to harvest credentials through tools like WebBrowserPassView and deepen their foothold within target networks.

What distinguishes this campaign is the seamless integration of legitimate RMM tools into criminal infrastructure.

Unlike traditional remote access trojans, these commonly used software packages often bypass security detection mechanisms due to signed installer packages and legitimate reputation.

Threat actors subsequently leverage compromised access to delete existing freight bookings, manipulate dispatcher notifications, and coordinate the theft directly using the victim’s own infrastructure.

According to the National Insurance Crime Bureau, cargo theft causes approximately $34 billion in annual losses, with projections indicating a 22 percent increase in 2025.

Proofpoint has documented nearly two dozen campaigns within just two months, suggesting this exploitation trend will continue accelerating as criminals recognize the effectiveness and profitability of cyber-enabled cargo theft operations.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.