Nov 03, 2025Ravie LakshmananCybercrime / Provide Chain Assault
Dangerous actors are more and more coaching their sights on trucking and logistics corporations with an intention to contaminate them with distant monitoring and administration (RMM) software program for monetary achieve and in the end steal cargo freight.
The risk cluster, believed to be lively since no less than June 2025 in accordance with Proofpoint, is alleged to be collaborating with organized crime teams to interrupt into entities within the floor transportation business with the tip objective of plundering bodily items. Probably the most focused commodities of the cyber-enabled heists are meals and beverage merchandise.
“The stolen cargo most certainly is offered on-line or shipped abroad,” researchers Ole Villadsen and Selena Larson mentioned in a report shared with The Hacker Information. “Within the noticed campaigns, risk actors intention to infiltrate corporations and use their fraudulent entry to bid on actual shipments of products to in the end steal them.”
The campaigns share similarities with a earlier set of assaults disclosed in September 2024 that concerned focusing on transportation and logistics corporations in North America with data stealers and distant entry trojans (RATs) similar to Lumma Stealer, StealC, or NetSupport RAT. Nonetheless, there isn’t a proof to counsel that they’re the work of the identical risk actor.
Within the present intrusion wave detected by Proofpoint, the unknown attackers have leveraged a number of strategies, together with compromised electronic mail accounts to hijack current conversations, focusing on asset-based carriers, freight brokerage companies, and built-in provide chain suppliers with spear-phishing emails, and posting fraudulent freight listings utilizing hacked accounts on load boards.
“The actor posts fraudulent freight listings utilizing compromised accounts on load boards after which sends emails containing malicious URLs to carriers who inquire concerning the hundreds,” it mentioned. “This tactic exploits the belief and urgency inherent in freight negotiations.”
Evidently, the malicious URLs embedded throughout the messages result in booby-trapped MSI installers or executables that deploy authentic RMM instruments like ScreenConnect, SimpleHelp, PDQ Join, Fleetdeck, N-able, and LogMeIn Resolve. In choose cases, a number of of those applications are used collectively, with PDQ Join getting used to drop and set up ScreenConnect and SimpleHelp.
As soon as distant entry is obtained, the attackers transfer to conduct system and community reconnaissance, adopted by dropping credential harvesting instruments similar to WebBrowserPassView to seize further credentials and burrow deeper into the company community.
In no less than one case, the risk actor is believed to have weaponized the entry to delete current bookings and block dispatcher notifications, after which added their very own system to the dispatcher’s telephone extension, booked hundreds below the compromised service’s title, and coordinated the transport.
The usage of RMM software program provides a number of benefits. First, it obviates the necessity for risk actors to plot bespoke malware. Second, it additionally permits them to fly below the radar, owing to the prevalence of such instruments in enterprise environments, and are sometimes not flagged as malicious by safety options.
“It is pretty simple for risk actors to create and distribute attacker-owned distant monitoring instruments, and since they’re usually used as authentic items of software program, finish customers is perhaps much less suspicious of putting in RMMs than different distant entry trojans,” Proofpoint famous again in March 2025. “Moreover, such tooling could evade anti-virus or community detection as a result of the installers are sometimes signed, authentic payloads distributed maliciously.”
