Cargo Theft Attack Chain
In the shadows where cybercrime meets organized theft, a new breed of criminal has emerged. They don't wear masks or carry weapons. They wield keyboards and exploit trust. Between August and November 2025, nearly two dozen coordinated campaigns weaponized legitimate remote access tools to infiltrate trucking carriers and freight brokers. Their target: billion-dollar cargo shipments moving across America's highways. Using phishing emails disguised as rate confirmations, these threat actors installed remote monitoring software, harvested credentials, and accessed dispatch systems in real-time. They tracked high-value loads, hijacked bookings, and coordinated with crime rings to intercept trucks carrying everything from energy drinks to copper worth millions. Average loss per incident: $356,787. This is the convergence of digital intrusion and physical crime. This is cyber-enabled cargo theft.
Cyber-Enabled Cargo Theft: Attack Chain
Understanding how threat actors progress from initial access to physical theft
- Phishing emails targeting logistics staff
- Compromised load board credentials
- Business email compromise (BEC)
- Social engineering attacks
- Fake rate confirmation documents
- Malicious carrier packets
- Links to credential harvesting sites
- Example domain: Rateconfirm1.net
- Remote monitoring and management tools
- SimpleHelp, ScreenConnect, AnyDesk
- Signed software bypasses antivirus
- Persistent remote access established
- Complete system access achieved
- Appears as legitimate IT support
- Can monitor user activity in real-time
- Access to all files and applications
- TMS (Transportation Management System) credentials
- Load board login information
- Email account passwords
- Tools: WebBrowser PassView, credential stealers
- Monitor dispatch operations in real-time
- Identify high-value cargo shipments
- Access route and delivery schedules
- Gather carrier and driver information
- Book loads using stolen credentials
- Hijack legitimate shipments in transit
- Coordinate with organized crime networks
- Average loss: $356,787 per incident
Watch for These Red Flags
Suspicious Emails About Loads
- Unexpected attachments with .exe, .msi, or .zip extensions
- Requests to download software to view documents
- Emails from addresses that look almost right but have subtle differences
- Urgent language pressuring immediate action
Domains That Look Almost Right
- Look for typos or character substitutions (e.g., 'rn' instead of 'm')
- Check for extra hyphens or unusual domain extensions
- Verify the sender's domain matches previous legitimate emails
- Hover over links before clicking to preview the actual URL
Unexpected Software Installation Requests
- Never install software requested via email or chat
- Legitimate IT support will use approved company channels
- Remote access tools give complete control of your computer
- Contact your IT team if you're unsure about any software request
Urgent or Pressure Tactics
- Pressure to act immediately without verification
- Threats of losing the load if you don't respond quickly
- Requests to bypass normal company procedures
- Take a breath and verify—legitimate opportunities will wait
Load Board Accounts Behaving Oddly
- Unexpected password reset notifications
- Loads posted or accepted that you don't recognize
- Unable to log in with correct credentials
- Change passwords immediately and contact the load board provider
System Anomalies
- Missing or altered records in your TMS
- Phone system changes you didn't authorize
- Unknown devices connected to your network
- Report any anomalies to IT immediately
Action Items Checklist
Implement multi-factor authentication on ALL load board and email accounts—no exceptions.
Enable MFA immediately across all systems to prevent unauthorized access even if credentials are compromised.
Block the installation of unauthorized remote access tools on company computers. Your IT team can configure this.
Prevent RMM tools like SimpleHelp, ScreenConnect, and AnyDesk from being installed without IT approval.
Train your entire team to identify these tactics. Forward this alert to dispatchers, owner-operators, and anyone who handles load communications.
Share threat intelligence and train all staff on phishing recognition and social engineering tactics.
If you receive a suspicious email, don't click—verify. Call the sender using a phone number you find independently, never one provided in the email.
Always verify requests through a separate communication channel before clicking links or downloading files.
Report incidents immediately. Contact the FBI at 1-800-CALL-FBI, your local field office, or file a report at IC3.gov.
Rapid reporting helps law enforcement track campaigns and protect other companies in the industry.
Built by OT penetration pioneers who've broken into hundreds of critical infrastructure organizations worldwide. We deliver actionable intelligence on the attack chains that matter, the controls that fail, and the defenses that work.
Need help with your cybersecurity?
📄 Read the Full Bulletin