Beyond the Breach: Inside a Cargo Theft Actor’s Post-Compromise Playbook

In late February 2026, Proofpoint researchers executed a malicious payload from a threat actor targeting transportation organizations inside a controlled decoy environment operated by their partners at Deception.pro. Unlike typical short-lived sandbox observations, the environment was intentionally left accessible for over 30 days, enabling full-spectrum visibility into post-compromise activity, operator decision-making, and iterative tooling deployment.The attacker abused multiple remote access tools to establish persistence, including the use of a previously unknown third-party signing-as-a-service capability. Proofpoint also observed extensive reconnaissance to identify financial access, payment platforms, and cryptocurrency assets to enable freight fraud and broader financial theft. Reconnaissance specifically targeting fuel card services, fleet payment platforms, and load board operators was likely intended to enable transportation-related crimes, including cargo theft.This report documents the full operational lifecycle of that intrusion.

Background: A Maturing Threat Cluster

The threat cluster engaged in suspected cargo theft has been active since at least June 2025, though evidence suggests the group’s campaigns began as early as January. Proofpoint assesses with high confidence that the threat actors are working with organized crime groups to compromise entities in the surface transportation industry — in particular trucking carriers and freight brokers — to hijack cargo freight, leading to the theft of physical goods. The stolen cargo is most likely sold online or shipped overseas.

Cargo theft leads to an estimated $35 billion in losses each year, and this kind of attack poses a risk to the supply chain unlike that commonly seen in cybersecurity research. Public discussion and reporting on cyber-enabled cargo theft suggests the problem is widespread, impacting organizations nationwide, and only increasing in scope.

Initial Access: Load Board Compromise and VBS Payload Delivery

On February 27, 2026, after compromising a load board platform, the actor delivered a malicious payload via email to transportation carriers inquiring about fraudulent advertised loads. Load board platforms are online marketplaces that connect shippers and freight brokers with motor carriers by advertising available loads.

The actors compromise load boards by posting fraudulent freight listings using stolen accounts, then send emails with malicious URLs to carriers who inquire about the loads. This approach exploits the trust and urgency typical of freight negotiations. In some cases, the threat actor creates domains and landing pages that impersonate legitimate brands or generic transportation terms to further the believability of the social engineering.

The delivered payload was a Visual Basic Script (VBS) file. The execution chain proceeded as follows:

The PowerShell stage functioned as a lightweight loader, staging persistence mechanisms and downloading remote management tools from attacker-controlled infrastructure. The VBS payload carried SHA256 hash 1f89a432471ec2efe58df788c576007d6782bbdf5b572a5fbf5da40df536c9f5.

Persistence Engineering: Redundant Remote Access Layering

Once access was established, the actor focused heavily on remote administration and redundancy. The use of multiple concurrent RMM platforms suggests deliberate redundancy designed to preserve access even if one tool is detected or disabled.

Over the following month, the actor installed six separate remote access tools:

Researchers believe the stacking of four ScreenConnect instances was an attempt to maintain remote control in case any of them were taken down.

Each tool likely established unique service entries, scheduled tasks or registry-based autoruns, and independent C2 communication paths. This multi-channel architecture complicates incident response by requiring complete eradication across heterogeneous access mechanisms.

Relevant MITRE ATT&CK mappings:

C2 Infrastructure (Defanged):

Trust Subversion: Signing-as-a-Service

The fourth ScreenConnect instance, downloaded in late March, stood apart from earlier installations. The last downloaded ScreenConnect tool presented a surprise: the use of a script that automatically queried an external certificate signing service. This enabled all installed components to be signed with a certificate that Windows perceived to be trusted.

The observed technique unfolded as follows:

1. An existing ScreenConnect session was used for lateral execution
2. A PowerShell script submitted the installer binary to an external signing service (signer.bulbcentral[.]com)
3. The service re-signed the binary with a fraudulently obtained but technically valid code-signing certificate
4. The signed payload was hosted on attacker-controlled Amazon S3 infrastructure (services-sc-files.s3.us-east-2.amazonaws[.]com)
5. Locally installed binaries previously signed with revoked ConnectWise certificates were replaced with the newly signed versions

Certificate Details:

This bypass effectively defeated certificate revocation checks, SmartScreen reputation systems, and endpoint trust enforcement policies.

Proofpoint’s researcher Ole Villadsen noted this capability appears to be an adaptation to recent security efforts by ScreenConnect to revoke existing certificates, which

disrupted the whole RMM ecosystem significantly. Rather than each actor independently obtaining certificates, this signing service effectively commoditized trust laundering. Not only was the MSI signed, but it would also go out and replace all the component files and re-sign them as well. The whole thing was thought out pretty well.

Relevant MITRE ATT&CK mappings:

Operator Activity: Manual Reconnaissance and Financial Profiling

Approximately three days post-compromise, interactive hands-on-keyboard (HOK) activity was observed, indicating a shift from automated staging to deliberate operator-driven targeting.

Approximately three days after intrusion, the actor manually accessed the PayPal website through the user’s browser. Eight days into the intrusion, the actor used ScreenConnect to execute a PyInstaller-packed binary designed to scan for browser extension and desktop cryptocurrency wallets and exfiltrate positive findings to attacker-controlled Telegram bots. These actions indicate discretionary, operator-driven targeting rather than purely automated malware execution.

A notable late-March escalation was also observed: the actor ran an additional PowerShell script through ScreenConnect’s custom property feature to quietly collect endpoint intelligence and report it back through the existing remote-access channel. It enumerated installed antivirus software and checked for the presence of high-value financial, tax, accounting, and cryptocurrency applications. The results were automatically returned to the attacker’s ScreenConnect console without generating separate network traffic or alerts.

Relevant MITRE ATT&CK mappings:

Automated Reconnaissance: PowerShell Profiling Framework

During the intrusion, Proofpoint observed at least 13 PowerShell scripts executed by the threat actor which, collectively, focused on determining whether the compromised host belonged to a financially valuable target.

Capabilities included:

Targeted platforms and services included U.S. financial institutions, money transfer services, online accounting systems, interbank payment platforms, freight brokerage ecosystems, and fleet fuel card management systems. All collected data was structured and transmitted to Telegram-based operator dashboards for triage and decision-making.

Relevant MITRE ATT&CK mappings:

Operational Objective: Financial Exploitation and Physical Freight Diversion

The breadth of these targets strongly aligns with financially motivated theft, fraud, and cargo diversion operations tied to transportation workflows. In particular, targeting of fuel card services, fleet payment platforms, and freight brokerage systems indicates intent to enable crimes against the transportation industry, including freight diversion and cargo theft.

When hackers maliciously take ownership of a load, sometimes the truckers are working directly with the criminals. Other times, the criminals use a technique known as “double brokering,” where loads are resold to a legitimate trucking company that believes they are transporting goods legitimately. In all cases, these operations require people to be physically present to get their hands on the goods, and the goods will be delivered to a location or warehouse controlled by the criminals.

The ultimate pivot to cargo theft involves manipulating core logistics systems: deleting legitimate bookings, blocking dispatcher notifications, and adding an attacker-controlled device to the dispatcher’s phone extension to book and coordinate the actual transport of the stolen freight.

Strategic Assessment

This intrusion highlights five key trends in financially motivated cyber operations targeting the transportation sector:

Defensive Recommendations

Proofpoint recommends restricting the download and installation of RMM tooling not approved by the organization’s IT administrators, implementing network detections, refraining from downloading executable files delivered via email from external senders, and training users to identify and report suspicious activity. Organizations in the transportation sector should additionally consult the National Motor Freight Traffic Association Cargo Crime Reduction Framework.

Specific detection opportunities include:

References: