Notifications
Clear all
Topic starter
14/07/2026 4:23 pm
TL;DR: Cybercriminals are compromising trucking and freight companies with RMM tooling, then using that access to hijack load boards, impersonate carriers, and steal physical cargo, with nearly two dozen campaigns observed since August 2025, according to Proofpoint. The pattern shows that trust in email, load boards, and remote access software now creates a direct fraud path into supply chain operations.
NHIMG editorial — based on content published by Proofpoint: cybercriminals are using RMM tools to hijack trucking and freight operations for cargo theft
By the numbers:
- According to the National Insurance Crime Bureau, cargo theft leads to $34 billion in losses annually.
- According to NICB, cargo theft losses increased 27 percent in 2024, and losses are expected to increase another 22 percent in 2025.
- Proofpoint observed nearly two dozen campaigns since August 2025 targeting surface transportation entities to deliver RMMs.
Questions worth separating out
Q: What breaks when attackers compromise a freight or load-board account?
A: A compromised freight or load-board account can let attackers post fake loads, hijack existing conversations, and change booking details under a legitimate carrier’s name.
Q: Why do RMM tools help attackers in cargo theft campaigns?
A: RMM tools help because they look like normal remote support software while giving attackers persistent control of the victim machine.
Q: How can security teams reduce the risk of email-based freight fraud?
A: They should add independent verification for load postings, payment changes, and booking updates instead of relying on email continuity alone.
Practitioner guidance
- Restrict unapproved remote access tools Block installation of any RMM or remote support software that is not explicitly approved by IT and security administrators, and monitor for installers delivered through email or landing pages that impersonate freight documentation.
- Verify load-board and dispatch actions out of band Require a second verification step for new load postings, booking edits, and carrier payment changes when those actions originate from recently used or newly recovered accounts.
- Harden email-thread trust checks Detect and flag injected links, sender changes, and anomalous replies in active freight negotiation threads.
What's in the full report
Proofpoint's full analysis covers the operational detail this post intentionally leaves for the source:
- The specific campaign sequencing used to move from compromised account to fraudulent freight booking and cargo theft.
- Examples of RMM payloads and installer behaviour observed across the campaign cluster.
- IOC listings, payload staging domains, and detection-signature references for network and endpoint teams.
- The report's timeline evidence linking activity back to earlier transport-sector targeting patterns.
👉 Read Proofpoint’s analysis of RMM-driven cargo theft campaigns in surface transportation →
RMM-led cargo theft: what transportation teams need to tighten now?
Explore further
14/07/2026 4:31 pm
Cargo theft is now an identity governance problem as much as a fraud problem. The article shows that access to a load board or dispatcher mailbox can be enough to trigger real-world theft, which means identity proofing and transaction authority are collapsing into the same control point. That matters because logistics environments often trust authenticated users too readily once the session is established. Practitioners should treat shipment approval as a governed identity action, not a routine workflow step.
A question worth separating out:
Q: Who is accountable when a cyber incident becomes cargo theft?
A: Accountability sits with the organisations that own the trust chain, not only the team that detected the compromise. Fleet operators, OEMs, brokers, and platform providers all have a role because each one can create or narrow the authority an attacker abuses. Governance frameworks such as NIST CSF and identity controls for non-human access help define that responsibility.
👉 Read our full editorial: Cargo theft gangs are using RMM tools to hijack freight operations
