Cybercriminals Exploit RMM Tools to Target Trucking Firms and Hijack Freight

Cybercriminals are exploiting remote monitoring and management (RMM) tools to target trucking firms and hijack freight, with campaigns described as aiming to steal cargo shipments worth millions. According to Proofpoint researchers, activity against trucking carriers and freight brokers has been tracked since at least June 2025, with some evidence suggesting operations began as early as January.

The attack chain typically starts by compromising broker load board accounts, posting fraudulent freight listings, and initiating contact with carriers using malicious URLs that install RMM software, granting attackers control over victims’ systems. Researchers list several RMM tools deployed in these campaigns, including ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve, with instances of multiple tools used simultaneously.

Public reports note cargo theft losses rising 27 percent in 2024, with a projected 22 percent increase expected in 2025, according to the National Insurance Crime Bureau. The article also highlights global hotspots identified by Munich Re and outlines defensive measures such as restricting unapproved RMM downloads, deploying network and endpoint protections, and training employees to recognise suspicious emails.