Hackers Weaponize Remote Tools to Hijack Cargo Freight

Researchers from Proofpoint have disclosed a campaign in which threat actors weaponise remote monitoring and management tools to hijack cargo freight, with attackers compromising load-board accounts, publishing fake listings and sending phishing links to freight carriers.

Since at least June 2025, and possibly earlier, the group has used multiple RMM tools—including ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able and LogMeIn Resolve—to gain initial access and then bid on real loads before intercepting the cargo. The operation often relies on phishing and thread hijacking to deliver malicious links, enabling the attackers to insert themselves into legitimate transport workflows.

Proofpoint notes that the campaign appears opportunistic, targeting carriers of all sizes rather than a specific set of companies. The activity contributes to cargo theft that researchers estimate costs across the supply chain, with losses running into billions of dollars annually, and the report urges organisations to restrict unapproved RMM tooling and to train users to recognise suspicious activity. This analysis was published by Proofpoint, according to an article by Dark Reading on 3 November 2025.