From phishing to freight: Hackers and crime rings unite in new cargo heist wave

The New Highwaymen: Hackers and Criminals Team Up to Rob Trucking Companies

The digital revolution has transformed nearly every facet of business, and it's no surprise that the criminal underworld is following suit. While traditionally the realms of cybercriminals and physical thieves operated on vastly different skill sets, a disturbing new trend is emerging: the unholy alliance between sophisticated hackers and old-school criminal syndicates. Proofpoint analysts have unveiled a chilling new wave of attacks where these disparate groups are merging their capabilities to target the trucking and freight brokerage industries, effectively bringing back the spirit of highway robbery, albeit with a digital twist.

The Digital Trojan Horse: How the Scheme Unfolds

The modus operandi begins with a seemingly innocuous email. Cybercriminals are bombarding logistics companies, freight brokers, and carriers with phishing messages containing malicious links. These links act as gateways, deploying Remote Monitoring and Management (RMM) tools such as ScreenConnect, PDQ Connect, SimpleHelp, Fleetdeck, LogMeIn Resolve, or N-able. What makes these RMM tools particularly insidious is their legitimate nature; they are standard industry software, making them appear harmless and often evading detection by antivirus software. They function as digital Trojan horses, allowing attackers unfettered access to compromised systems.

Once inside, the hackers meticulously scout the network, pilfering credentials using tools like WebBrowserPassView. Armed with this stolen information, they begin to manipulate the system, submitting fraudulent load requests or posting fake advertisements on freight exchange platforms. When a legitimate carrier responds to these deceptive listings, their own systems become infected, granting the criminals the ability to operate under the guise of the carrier's identity. The operation then escalates into a classic scam. Attackers systematically delete genuine bookings, silence the dispatcher, impersonate company representatives to communicate with drivers, and reroute trucks to fictitious pickup locations where waiting accomplices are ready to abscond with the cargo. The stolen goods are then peddled online or smuggled across borders.

While researchers have not yet reported instances of physical violence, the very nature of this crime poses a significant risk to drivers, especially if they are unaware that their company's systems are being manipulated. This new breed of criminal isn't just after digital data; they're orchestrating real-world heists.

Echoes of the Past, Powered by the Future

The theft of cargo is a crime as old as civilization itself, harkening back to the days of horse-and-buggy bandits. Today, however, the principles remain the same, but the tools are undeniably modern. Instead of a trusty revolver, the weapon of choice is a phishing email; instead of a treacherous mountain pass, the ambush point is a logistics company's server. Proofpoint has been tracking the activity of these evolving criminal enterprises since January 2025, identifying nearly two dozen distinct campaigns in recent months alone. These operations vary in scale, from those involving a handful of emails to others exceeding a thousand. Often, the targets are not specific companies but any carrier that falls prey to the fake load advertisements, highlighting a broad, opportunistic approach.

The financial ramifications are already staggering. According to the U.S. National Motor Vehicle Theft and Insurance Association, cargo theft losses surged by 27% in 2024 and are projected to climb another 22% in 2025, potentially exceeding a mind-boggling $34 billion annually. Vulnerable regions include the United States, Mexico, Brazil, Germany, India, Chile, and South Africa, with common targets being food, beverages, and electronics. This phenomenon is not isolated; it's a global trend. The proliferation of digital freight management systems, while enhancing efficiency, has inadvertently created new vulnerabilities that organized criminal groups are now ruthlessly exploiting. They are leveraging the very same technologies that empower legitimate businesses, but to perpetrate crime.

Fortifying the Digital Gates: Protective Measures

Proofpoint offers critical recommendations for transportation companies and brokers to safeguard their operations. A paramount step is to strictly limit the installation of any RMM tools that haven't received explicit approval from the IT department. Robust network detection and antivirus rules should be implemented to identify and flag unauthorized RMM connections. Furthermore, personnel must be rigorously trained to never open executable (.exe) or Windows Installer (.msi) files received via email and to report any suspicious activity immediately. Educating staff on recognizing phishing attempts is no longer optional; it's a fundamental layer of defense.

The era of the digital highwayman is upon us. These 'bandits of the modern age' are now operating through remote access, turning legitimate software into instruments of theft. Proofpoint issues a stark warning: this trend is set to accelerate, with cyberattacks increasingly serving as the prelude to tangible, physical cargo thefts. Companies that fail to bolster their defenses risk a future where their digital vulnerabilities directly translate into empty warehouses and vanishing fleets.