Cargo theft actors are laundering trust through remote access tools

At a glance

What this is: Proofpoint tracked a cargo theft actor persisting for more than a month through multiple remote access tools and a signing-as-a-service workflow that preserved trust in malicious ScreenConnect installs.

Why it matters: It matters because defenders must treat remote management abuse, certificate trust manipulation, and browser-based reconnaissance as linked controls problems, not separate incidents.

Context

Remote access tools become a security problem when they are repurposed as persistence infrastructure, because the same features that help administrators support users also help attackers keep access alive. In this case, the transport fraud angle matters because the actor was not just maintaining access, but probing financial systems, payment platforms, and logistics services tied to cargo theft.

The identity and trust angle is the core governance issue. When an attacker can re-sign binaries, suppress warnings, and keep remote administration software looking legitimate, the control failure is not only endpoint hygiene but trust lifecycle governance across software provenance, remote administration, and operator privilege boundaries.

Key questions

Q: What breaks when attackers can keep trusted remote access tools on a host?

A: The normal split between administration and compromise disappears. If an attacker can run multiple remote access tools, re-sign binaries, and preserve trust warnings, removal becomes harder and containment depends on finding the tooling inventory gap, not just blocking one payload.

Q: Why does signing-as-a-service make remote access abuse harder to detect?

A: Because it lets an attacker turn an otherwise suspicious installer into a file that appears properly signed and therefore less alarming to users, controls, and some allowlisting workflows. That shifts the problem from malware visibility to trust provenance and certificate lifecycle oversight.

Q: What do security teams get wrong about remote support tools?

A: Teams often treat remote support tools as neutral utilities, but they become high-risk when an attacker uses user consent to gain interactive control of an endpoint. The mistake is focusing only on the tool’s legitimacy instead of the context in which it is invoked. Approval, verification, and logging matter as much as allow-listing.

Q: How should organisations respond when browser activity suggests payment-system targeting?

A: Escalate the case as a potential fraud-enablement event, not just a malware infection. Browser history, profile enumeration, and access to accounting, fuel card, or load board services indicate the operator is mapping monetisation paths and business authority, so telemetry review should be immediate.

Technical breakdown

How remote access tools become attacker persistence

Remote monitoring and management tools are attractive to intruders because they provide durable, interactive control with little need for custom malware. In this case, multiple ScreenConnect instances, Pulseway RMM, and SimpleHelp RMM created redundancy, so the actor could preserve access even if one path was disrupted. That is materially different from a one-off payload: the attacker is building an access layer that behaves like a shadow administration stack. In identity terms, that stack inherits trust from the environment and can outlive the initial compromise if it is not inventory-governed.

Practical implication: inventory all remote management tooling, verify ownership and approval, and treat duplicate RMM installs as a containment event.

Why signing-as-a-service changes trust assumptions

Code signing normally helps users and platforms distinguish trusted software from tampered binaries. The actor inverted that model by using a third-party signing service to re-sign ScreenConnect installers and components with a certificate that Windows still treated as valid. That allowed the malicious installation chain to bypass ordinary trust warnings and survive revocation of the original vendor certificates. The technical issue is not only malware delivery, but certificate laundering, where trust is transferred through a legitimate-seeming signing workflow. Once that occurs, allowlisting and user-facing prompts become less reliable containment signals.

Practical implication: tie trust decisions to signer provenance and certificate lifecycle monitoring, not just to whether a binary is visibly signed.

How browser reconnaissance supports fraud targeting

The post-compromise scripts did not merely look for random data. They enumerated browser profiles, extracted history, matched hard-coded URLs, and searched for evidence of access to banking, accounting, fleet payment, fuel card, and load board services. That pattern shows reconnaissance aimed at determining whether the victim had financial authority and operational reach worth exploiting. It also explains why browser telemetry matters in fraud cases: the browser often reveals the real business role behind the endpoint. In this type of operation, discovery is an access and monetisation step, not just an intelligence-gathering exercise.

Practical implication: monitor browser artefacts and endpoint telemetry for searches tied to payment, logistics, and financial services on privileged or high-value user devices.

Threat narrative

Attacker objective: The attacker aimed to keep durable remote access while identifying financial and logistics systems that could be abused for cargo theft and broader monetisation.

1. Entry occurred after the actor compromised a load board platform and delivered a malicious VBS payload to transportation targets through fraudulent load-related email.
2. Credential and session abuse followed when the actor used ScreenConnect and other remote access tools to maintain interactive control and preserve access across the intrusion.
3. Persistence was reinforced by a signing-as-a-service workflow that re-signed ScreenConnect binaries with a certificate Windows still trusted, reducing detection and bypassing revocation controls.
4. Impact was the collection of browser, payment, and financial-access intelligence to support freight fraud, cargo theft, and related financial theft.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trust laundering is now a persistence strategy, not a side effect. The notable shift in this case is that the attacker did not rely only on remote administration abuse. By re-signing binaries and keeping them trust-valid, the actor turned certificate and warning systems into part of the persistence layer. That means defenders must think about software trust as an active attack surface, not just a deployment concern.

Remote management redundancy reveals a control gap in access ownership. Multiple concurrent RMM tools indicate the actor was building resilience against detection or removal. That pattern only works where organisations lack strict control over what remote support software may exist, who approved it, and how quickly it can be removed. The governance failure is not simply tool sprawl, but unmanaged privileged access infrastructure.

Signing-as-a-service abuse broadens the NHI problem into software trust governance. The article shows that attacker tradecraft can use legitimate external services to preserve malicious trust chains. That matters beyond this case because modern enterprise control stacks often assume the signature, certificate, or vendor label is enough to trust a binary. Practitioners should treat signed malware as a supply-chain-adjacent trust failure, not an edge case.

Named concept: trust laundering through remote access. This describes the pattern in which attackers combine remote administration tools, valid-looking signatures, and revocation evasion to keep access operational. It is especially dangerous because each element appears individually mundane, but together they preserve long-lived, low-friction access. The practical lesson is to govern trust lifecycles as aggressively as access lifecycles.

Transport fraud now depends on identity and payment discovery, not only initial compromise. The actor’s browser and endpoint recon activity focused on the systems that reveal who can move money, not just who owns the host. That aligns with a broader fraud trend in which compromise is followed by role discovery and payment-path mapping. Practitioners should therefore review how endpoint telemetry informs fraud detection and access assurance.

What this signals

Trust laundering through remote access is becoming a repeatable intrusion pattern. Attackers are no longer content to merely install RMM software. They are trying to make malicious access look administratively normal, which means defenders need tighter control over signer provenance, remote tool inventory, and approval workflows.

For transport and logistics organisations, the real control boundary is the path from endpoint compromise to payment discovery. When browser artefacts, fleet services, and load board access all sit on the same host, the compromise is already close to monetisation. That raises the value of endpoint monitoring that can distinguish ordinary admin activity from fraud-oriented reconnaissance.

For practitioners

• Harden remote access approval and inventory Maintain an authoritative inventory of every RMM and remote support tool, then require explicit approval for each installation and service account that can run it.
• Detect trust laundering in signed binaries Alert when a newly introduced certificate, signer, or re-signed installer appears in conjunction with remote administration software or self-deleting scripts.
• Review browser telemetry for fraud targeting Prioritise endpoints that expose browser history, profile enumeration, and searches for payment, fuel card, accounting, or load board services.
• Treat duplicate RMM installations as a compromise signal Investigate systems that host more than one remote management platform, especially where the tools were installed close together or across different operator accounts.
• Constrain outbound telemetry from high-value users Limit what remote access tools and scripts can send to external consoles, bots, or storage endpoints from finance-sensitive and operations-sensitive devices.

Key takeaways

• The intrusion combined remote access abuse with trust manipulation, showing that persistence can now depend on making malicious binaries appear legitimate.
• The actor’s reconnaissance focused on browser history, payment systems, and logistics services, which is consistent with freight fraud and cargo theft preparation.
• Defenders need to govern remote support tooling, certificate trust, and browser telemetry together because each control covers only part of the attack path.

Key terms

• Trust Laundering: Trust laundering is when untrusted content gains trusted authority simply by passing through a tool that assumes the source is safe. In AI-assisted development, that can happen when repository files or hooks silently shape what the model sees, turning evidence selection into a security control.
• RMM Abuse: RMM abuse is the misuse of remote monitoring and management software to gain or maintain access inside an environment. The tools are often legitimate, signed, and operationally common, which allows attackers to hide in normal administrative activity unless defenders track context, provenance, and lifecycle ownership.
• Signing-As-A-Service: Signing-as-a-service is a third-party workflow that re-signs files or installers, usually to preserve or alter perceived trust. In this case, the concept matters because attackers used it to re-sign remote access software, which reduced warnings and helped malicious components remain trusted by the operating system.
• Browser Reconnaissance: Browser reconnaissance is the use of browser-native features and scripts to collect information about the victim environment. Attackers may enumerate extensions, probe network-related APIs, and fingerprint the device to tailor follow-on activity. Because much of this happens in the browser runtime, it can evade traditional network-centric monitoring.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle controls. It helps security and IAM practitioners connect access governance to the broader control problems that attackers exploit.