Crooks exploit RMM software to hijack trucking firms and steal cargo

Crooks are targeting trucking and logistics firms by weaponising remote monitoring and management (RMM) tools to hijack cargo and steal freight, a campaign active since June 2025 and linked to organised crime. The crew hijacks cargo bids, uses compromised load boards, email thread hijacking, and direct campaigns to deliver malicious RMM payloads that grant attackers full control of systems.

RMM tools cited include ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve, with PDQ Connect observed deploying multiple RMMs in tandem; the activity has roots dating back to 2024 with DanaBot, NetSupport, Lumma Stealer and StealC noted in the wider campaign timeline.

Proofpoint, according to Proofpoint, tracks a cluster that targets trucking and logistics entities to hijack cargo freight, with the stolen goods most likely sold online or shipped overseas, and the attacks blamed for disrupting supply chains and costing firms millions.

The scheme focuses on a wide range of carrier sizes—from small family businesses to large transport operators—before exploiting insiders’ data to hijack or steal shipments, particularly in hotspots such as Brazil, Mexico, the U.S., Germany and India. Cargo theft has risen, with losses projected to grow further in 2025, while Proofpoint notes nearly two dozen campaigns since August 2025 delivering RMMs to such entities.