Transportation Companies Hacked to Steal Cargo

Threat actors have been hacking surface transportation firms to deploy remote access tools and hijack shipments for financial gain, according to Proofpoint notes. The attack chain begins with a compromised broker load board account used to post a fake load, with hackers then emailing malicious URLs to carriers that deliver remote monitoring and management tools.

They have also used compromised email accounts to inject malicious content and have launched direct campaigns against carriers, freight brokerages, and integrated supply chain providers. In nearly two dozen campaigns observed over the past several months, they deployed RMM tools such as Fleetdeck, LogMeIn Resolve, N-able, PDQ Connect, ScreenConnect and SimpleHelp, sometimes in tandem, and conducted credential harvesting with WebBrowserPassView once initial access is established.

Using the RMM tools, the attackers take control of the carrier’s systems, book loads in the victim’s name, and divert shipments by manipulating scheduling and dispatch systems. Proofpoint notes that the attacks seek cargo hijacking and that cargo theft costs over $30 billion in losses each year, with hotspots including Brazil, Chile, Germany, India, Mexico, South Africa and the US.