Cyber-Enabled Cargo Theft: Hackers Hijack Logistics Firms with RMM Tools to Steal Physical Shipments

Proofpoint researchers have uncovered a sophisticated cyber-enabled cargo theft operation in which threat actors infiltrate trucking and logistics companies, use remote monitoring and management tools, and exploit industry-specific platforms to hijack freight shipments, with losses estimated at billions of dollars across the U.S. and global supply chains.

The researchers note that the operation combines social engineering and cyber intrusion, and that the threat actors typically deliver RMM tools such as ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve since at least June 2025. According to Proofpoint, once initial access is established, the actors conduct system and network reconnaissance and deploy credential harvesting tools, indicating a broader effort to compromise accounts and deepen access.

The report identifies three primary tactics: compromised load boards, where attackers post fraudulent listings and send malicious URLs; email thread hijacking, using stolen credentials to inject malicious links into business conversations; and direct targeting of large freight brokers and carriers with phishing emails containing malicious URLs or MSI installers.

The campaigns span North America but are described as a global problem, with hotspots in several countries and cargo types such as food, beverages, and electronics frequently stolen.