Cargo Theft Attack Chain

Recent threat intelligence reveals the operational convergence of cybercrime and organized crime in coordinated attacks targeting freight and logistics operations. Between August and November 2025, security researchers at Proofpoint identified nearly two dozen distinct campaigns where threat actors weaponized remote monitoring and management (RMM) tools to compromise trucking carriers and freight brokers, enabling the physical hijacking of cargo shipments.

• ▸Threat actors deploy legitimate RMM tools (ScreenConnect, SimpleHelp, N-able) to evade detection
• ▸Attacks leverage compromised freight marketplace (load board) accounts and email thread hijacking
• ▸Multi-stage attack chains include credential harvesting using WebBrowserPassView
• ▸Campaign volumes range from fewer than 10 to over 1,000 messages per campaign
• ▸Average loss per incident: $356,787

This bulletin examines the tactics, techniques, and procedures (TTPs) employed in these cyber-enabled operations, provides technical indicators of compromise, and delivers actionable prevention and protection recommendations for organizations in the freight, logistics, and transportation sectors.

The observed attack chains follow a multi-stage progression:

• ▸Initial Compromise - Freight marketplace (load board) account takeover via credential theft
• ▸Social Engineering - Fraudulent load postings and targeted phishing
• ▸Payload Delivery - RMM tool installation via malicious URLs
• ▸Reconnaissance - System enumeration and operational intelligence gathering
• ▸Credential Harvesting - Theft of authentication credentials for operational systems
• ▸Operational System Access - Compromise of transportation management systems
• ▸Physical Crime Facilitation - Load hijacking, double brokering, or interception

Load boards (also called freight marketplaces) are online platforms where freight brokers post available shipments and trucking carriers bid on or claim loads to transport. Major platforms include DAT, Truckstop.com, and 123Loadboard.

Proofpoint researchers assess with high confidence that cyber threat actors are collaborating with organized crime groups to execute the physical theft component of these operations. The stolen cargo is most likely sold online or shipped overseas.

Since August 2025, the following RMM tools have been observed as first-stage payloads:

• ▸Legitimate signed software avoids antivirus/EDR detection
• ▸Commonly used by IT support teams, blends with normal operations
• ▸Provides same capabilities as malware (remote access, credential harvesting, screen monitoring)
• ▸No need for sophisticated malware development
• ▸Lower detection rates compared to traditional RATs

Cargo theft operations demonstrate strategic targeting based on illicit market value:

• ▸Food and Beverage Products: 180 reported incidents (68% increase from Q2 2024) Alcoholic beverages
• ▸Energy drinks
• ▸Meat products
• ▸Metals: 96% year-over-year surge to 53 incidents (copper at record highs)
• ▸Electronics: High-value consumer electronics and components

Stopping attacks in stages 1-3 prevents all downstream damage.

Organizations must focus defensive efforts on initial access vectors, email security, and unauthorized software installation prevention.

• ▸Deploy email security gateway with URL rewriting and sandboxing
• ▸Enable DMARC, SPF, and DKIM authentication
• ▸Implement visual indicators for external emails
• ▸Configure enhanced filtering for freight-related keywords (load, pickup, delivery, BOL)
• ▸Block executable attachments from external sources
• ▸Mandate MFA for all load board accounts (DAT, Truckstop.com, etc.)
• ▸Require MFA for VPN and remote access
• ▸Enable MFA on TMS platforms and dispatch systems
• ▸Implement hardware security keys for high-privilege accounts
• ▸Enforce unique passwords across all platforms
• ▸Create whitelist of approved remote access tools
• ▸Block installation of unauthorized RMM software
• ▸Require approval workflow for any remote access tool deployment
• ▸Conduct quarterly inventory of installed remote access capabilities
• ▸Deploy EDR on all endpoints including dispatch workstations
• ▸Configure alerts for RMM tool installations
• ▸Monitor for credential access and harvesting behaviors
• ▸Detect unusual VPN connections (time, location, duration)
• ▸Alert on multiple failed authentication attempts
• ▸NMFTA Cybersecurity Cargo Crime Reduction Framework (June 2025) - Actionable guidance for carriers, shippers, and 3PLs
• ▸C-TPAT (Customs-Trade Partnership Against Terrorism) - Supply chain security program with expedited cargo processing benefits

If you receive a suspicious email, don't click—verify.

Call the sender using a phone number you find independently, never one provided in the email. Establish phone verification for new loads or unusual requests.

The following domains have been used to deliver RMM tool payloads. Organizations should block these at the network level:

• ▸carrier-packets[.]net
• ▸claimeprogressive[.]com
• ▸confirmation-rate[.]com
• ▸wjwrateconfirmation[.]com
• ▸rateconfirm[.]net
• ▸ilove-pdf[.]net
• ▸vehicle-release[.]com
• ▸carrierpack[.]net
• ▸car-hauling[.]com
• ▸fleetcarrier[.]net
• ▸scarrierpack[.]com
• ▸carrieragreements[.]com
• ▸brokeragepacket[.]com
• ▸brokerpackets[.]com
• ▸centraldispach[.]net (note: missing 't' in dispatch)
• ▸carriersetup[.]net
• ▸brokercarriersetup[.]com
• ▸billpay-info[.]com
• ▸nextgen223[.]com
• ▸fleetgo0[.]com
• ▸nextgen1[.]net
• ▸ratecnf[.]com
• ▸ratecnf[.]net

• ▸Unexpected emails containing load documentation from unknown senders
• ▸Emails with URLs to file sharing services related to loads
• ▸Thread hijacking where legitimate conversation suddenly includes unexpected links
• ▸Emails referencing loads not in current systems
• ▸Rate confirmations with .exe or .msi file attachments
• ▸Unauthorized installation of remote access tools
• ▸New RMM software appearing on dispatch or TMS workstations
• ▸Unusual VPN connections outside normal business hours
• ▸Multiple concurrent VPN sessions from single user account
• ▸Bulk extraction of shipment data or customer lists
• ▸Changes to load assignments or routing not initiated by dispatchers
• ▸Carriers showing up for loads they didn't officially book
• ▸Discrepancies between load board assignments and internal dispatch records
• ▸Shipments not arriving at scheduled destinations
• ▸Customer complaints about undelivered freight
• ▸Double-brokered loads discovered through carrier verification

Organizations should implement the following detection rules in SIEM platforms or log management systems. Click on each category to view detailed Sigma rules for implementation.

Detects emails containing freight/load-related keywords with links to external file sharing services

Detects potential email thread hijacking where legitimate conversation suddenly includes unexpected links

Detects emails referencing loads not in current systems or unexpected load documentation

Detects installation of RMM tools commonly used in cargo theft operations

Detects network connections from RMM software to external infrastructure

Detects VPN connections occurring outside expected business hours

Detects multiple simultaneous VPN sessions from same user account indicating potential credential compromise

Detects VPN access from geographic locations inconsistent with user baseline

Detects unusual bulk extraction of shipment data from TMS databases

Detects database connections to TMS from unusual or external IP addresses

Detects changes to load assignments or routing not initiated by authorized dispatchers

Detects execution of credential stealing tools including WebBrowserPassView

Detects unusual access to browser credential storage locations

Detects reconnaissance activity focused on transportation and dispatch systems

Consider creating correlation rules that fire when multiple conditions occur:

• ▸RMM tool installation + VPN access anomaly = HIGH priority alert
• ▸Email with suspicious links + Credential access = Potential compromise
• ▸Bulk data extraction + Large cloud upload = Data exfiltration attempt

Organizations can implement the following Proofpoint Emerging Threats signatures for network-level detection:

Organizations experiencing cargo theft enabled by cyber intrusion should report to:

• ▸FBI Internet Crime Complaint Center (IC3): https://www.ic3.gov/
• ▸DHS CISA: Email: [email protected] https://www.cisa.gov/report
• ▸National Motor Freight Traffic Association (NMFTA): https://www.nmfta.org/

• ▸National Insurance Crime Bureau (NICB): Cargo theft data and trends https://www.nicb.org/
• ▸CargoNet: Cargo theft prevention and recovery services https://www.cargonet.com/
• ▸NMFTA Cargo Crime Reduction Framework: Industry best practices https://info.nmfta.org/nmfta-cybersecurity-cargo-crime-reduction-framework

• ▸FBI Field Offices: Contact local field office for cargo theft investigations
• ▸State Fusion Centers: Regional threat information sharing
• ▸Local Law Enforcement: File reports for physical theft incidents

The convergence of cybercrime and organized crime in freight cargo theft operations represents a significant evolution in threat actor monetization strategies. Unlike traditional cybercrime that targets data or demands ransom, these operations leverage digital access to facilitate physical theft of tangible goods valued in the billions annually.

The sophistication demonstrated—from detailed knowledge of freight operations to the use of legitimate remote access tools—indicates well-resourced threat actors with specific industry expertise. The coordination between digital compromise and physical crime execution suggests partnerships between cybercriminals and traditional organized theft groups.

Organizations in the freight, logistics, and transportation sectors must recognize that their operational systems are now direct targets for adversaries seeking financial gain through cargo theft.

Traditional physical security measures are insufficient when threat actors can digitally manipulate bookings, access shipment intelligence, and coordinate theft operations remotely.

Priority should be given to implementing multi-factor authentication, enhancing email security, establishing behavioral monitoring, and creating industry-specific threat awareness programs. As this threat continues to evolve, information sharing within the freight industry and collaboration with law enforcement will be critical to disrupting these operations and holding threat actors accountable.

Cyber Threat Bulletin: Cargo Theft Attack Chain

Version 1.1 | Published: November 19, 2025

This bulletin incorporates research from Proofpoint and industry partners.

For questions or additional information, contact: [email protected]