Rising Cyber Threats Drive Escalating Cargo Theft Crisis in Global Logistics

Key Findings

• Coordinated cyber attacks on logistics and trucking companies are directly enabling real-world cargo theft linked to organized crime

• North American cargo theft losses reached 6.6 billion dollars in 2025, with cyberattacks playing a central role

• Threat actors use remote management tools to maintain persistent access and coordinate freight theft operations

• Attackers deployed a novel "signing-as-a-service" technique to evade detection and establish trusted remote access

• The criminal workflow extends beyond initial compromise to include credential harvesting, financial system reconnaissance, and payment diversion

Background

Starting in June 2025, criminal groups began systematically targeting trucking and logistics firms with remote monitoring and management software. In November 2025, Proofpoint researchers first documented this emerging threat pattern. By February 2026, the attacks had evolved into a sophisticated operation combining cyber intrusion with organized crime networks to physically steal cargo. The primary targets have been food and beverage shipments, with attackers hijacking cargo bids and diverting goods for profit.

Initial Attack Vector

On February 27, 2026, attackers breached a load board platform and sent fraudulent emails to carriers advertising fake shipping jobs. The emails contained a malicious VBS file that executed a PowerShell script, installed ScreenConnect for remote access, and displayed a fake agreement to mask the intrusion from users. This social engineering approach proved effective at bypassing initial security awareness.

Persistence and Access Maintenance

Once inside target networks, attackers prioritized establishing redundant access. They deployed multiple instances of ScreenConnect alongside Pulseway and SimpleHelp remote management tools. This layered approach ensured continued access even if security teams detected and removed one tool. The attackers demonstrated sophisticated operational security by distributing their tooling across multiple platforms.

Signing-as-a-Service Technique

Researchers identified a novel evasion method where attackers used a PowerShell chain to download a ScreenConnect installer, had it re-signed with a fraudulent but cryptographically valid certificate, and then installed it silently. The attackers further replaced original components with signed versions to avoid triggering detection mechanisms and certificate revocation lists. This technique exploited the inherent trust placed in digitally signed software.

Post-Compromise Intelligence Gathering

After establishing stable remote access, threat actors shifted to manual reconnaissance and hands-on activities. They checked financial accounts like PayPal and deployed custom tools to extract cryptocurrency wallet credentials, sending stolen data to Telegram. Over a dozen PowerShell scripts were executed to profile victim environments, collecting browser history, user data, and indicators of access to banking platforms, payment processors, fleet management systems, and freight logistics platforms.

Targeting Financial and Logistics Systems

The reconnaissance activity showed a clear focus on stealing credentials from banks, money transfer services, fleet payment systems, and freight platforms. Attackers used scripts running with SYSTEM privileges to copy locked files, search for valuable services, and store collected data in hidden folders. Delayed task execution was employed to further evade security controls. This intelligence gathering directly prepared for financial fraud and cargo diversion operations.

Implications for the Industry

The research highlights how modern cargo theft operates as a hybrid cyber-physical crime. Attackers no longer rely solely on logistics knowledge or insider connections. Instead, they combine digital intrusions with organized crime networks to identify valuable shipments, manipulate shipping systems, and divert payments. Organizations must treat unauthorized remote management tools, suspicious PowerShell activity, and abnormal access to financial platforms as critical indicators of active compromise.

Sources

• https://securityaffairs.com/191008/security/cyber-attacks-fuel-surge-in-cargo-theft-across-logistics-industry.html

• https://x.com/securityaffairs/status/2045880185833046334

• https://x.com/hackplayers/status/2045895220231835909

• https://www.linkedin.com/posts/cybercureme_cyber-attacks-fuel-surge-in-cargo-theft-across-activity-7451660944033853440-x1WY

• https://www.socdefenders.ai/item/96501d83-5bd6-447c-bf4e-1ed693d0d072