Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks

According to Proofpoint, bad actors have been targeting trucking and logistics firms to deploy remote monitoring and management (RMM) software for financial gain, with the threat cluster active at least since June 2025 and said to be collaborating with organised crime groups to plunder physical goods, notably food and beverage products.

The attackers infiltrate companies by hijacking email conversations, spear-phishing carriers, and posting fraudulent freight listings on load boards using hacked accounts, then directing recipients to booby-trapped MSI installers or executables that deploy legitimate RMM tools such as ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve.

In some campaigns these tools are used in combination, for example PDQ Connect being employed to drop ScreenConnect and SimpleHelp, enabling reconnaissance, credential harvesting with WebBrowserPassView, and deeper network intrusion. The actors are reported to have, in at least one case, weaponised access to delete bookings, block dispatcher notifications, and even add a device to a dispatcher's phone extension to book loads under the compromised carrier’s name.

Proofpoint notes the use of RMM software provides advantages for attackers, including avoiding bespoke malware development and evading security solutions since such tools are common in enterprise environments and often signed, legitimate payloads.