The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a campaign tracked from late May 2024, attackers hijacked email accounts belonging to transportation and shipping companies, inserted malicious messages into existing conversations, and delivered malware including Lumma Stealer, StealC, and NetSupport. Proofpoint identified at least 15 compromised accounts. The activity is a warning about email and endpoint risks in freight businesses, but it is not proof that every infection led to cargo theft—or that the 2024 campaign and later freight-theft operations had the same operators.
How the 2024 campaign targeted transportation companies
Proofpoint’s Threat Research Team reported that the activity began by abusing compromised email accounts at transportation and shipping companies. The attackers placed malicious content inside existing conversations, making the messages appear in familiar business threads. Proofpoint identified at least 15 compromised email accounts; that figure is not a count of all affected companies or all victims.
The messages used lures imitating transport and fleet-management software, including Samsara, AMB Logistic, and Astra TMS. Proofpoint reported Google Drive links and URL-file attachments that led to malicious payloads. Its September 24, 2024 report said it was unclear how the attackers obtained access to the email accounts and did not attribute the activity to a named actor. The team assessed financially motivated criminal objectives with moderate confidence.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the observed payloads changed
| Observation window | What Proofpoint reported |
|---|---|
| May through July 2024 | The activity predominantly delivered Lumma Stealer, StealC, or NetSupport. |
| August 2024 | The actor changed infrastructure and delivery technique; Proofpoint also observed DanaBot and Arechclient2. |
These are Proofpoint’s observations in its September 2024 report, not a complete list of malware used against the sector. The report’s sample filenames and hashes are historical indicators, not a current blocklist; security teams should validate indicators against current threat intelligence before using them operationally.
#1 Best Overall
How an email compromise can connect to cargo theft—and where the evidence stops
An infostealer can put credentials at risk, while access to a business mailbox can make fraudulent messages more convincing. Those risks overlap with freight fraud, but the available reporting does not establish that infections in the 2024 campaign caused cargo theft. Proofpoint did not confidently connect its 2024 cluster to the activity it described in a separate November 2025 report.
That later Proofpoint report described trucking and logistics campaigns using remote-monitoring and management (RMM) tools. Tactics included compromised load-board accounts, fake freight listings, hijacked email threads, and direct email campaigns. Links could install legitimate RMM software, which may provide remote access and help attackers harvest credentials. Proofpoint observed nearly two dozen campaigns in the last two months covered by that report, with individual campaign volumes ranging from fewer than 10 to more than 1,000 messages. Those counts describe that specific observation window, not an annual rate. The reported targets ranged from small family-owned businesses to large transport firms.
The cargo-theft sequence described by the FBI
In an April 30, 2026 public-service announcement, the FBI’s Internet Crime Complaint Center (IC3) described a broader cyber-enabled cargo-theft pattern: criminals gain access to broker or carrier systems through spoofed messages, fake URLs, or compromised accounts; post fraudulent loads; pose as legitimate companies to obtain freight; alter shipment information; and divert cargo for resale. They may also change contact or insurance details. A company might first learn of the compromise when a broker asks about an unauthorized or missing shipment.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe FBI/IC3 estimated nearly $725 million in cargo-theft losses in the United States and Canada in 2025, a 60 percent increase from 2024. It also reported that confirmed cargo-theft incidents rose 18 percent in 2025 and that the average value per theft increased 36 percent to $273,990. These figures are the FBI/IC3’s estimates for cargo theft across the United States and Canada; they are not losses attributed to the 2024 malware campaign.
A separate threat: Russian GRU cyber-espionage
The NSA has separately reported that GRU Unit 26165 conducted a cyber-espionage campaign since at least February 2022 against Western government organizations, commercial logistics entities, transportation services, and technology companies, including some involved in support for Ukraine. The NSA listed password spraying, spearphishing, and changes to Microsoft Exchange mailbox permissions among the tactics. This is a distinct, state-sponsored threat set—not evidence that the financially motivated activity described by Proofpoint was conducted by the GRU.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controls for email, endpoints, and freight operations
No single control addresses the full chain from account access to shipment diversion. Proofpoint’s recommendations focus on malicious software and RMM use; the FBI’s focus includes verifying shipment identity and pickup details. Apply controls across both areas.
Quick Recap
Best Value
Reduce email and endpoint exposure
- Restrict downloads and installation of RMM tools to software approved by IT administrators. Monitor network activity involving RMM servers and use endpoint protection, as Proofpoint recommends.
- Do not install externally delivered EXE or MSI files merely because a message appears to come from a familiar vendor or active business thread. Report suspicious messages and unexpected software requests to IT.
- Train staff to recognize suspicious links and attachments, and to report possible compromise promptly. A familiar sender name is not enough to establish that a message is genuine.
Verify loads, carriers, and pickups independently
- Confirm unexpected shipment requests and pickup changes through a secondary, independently obtained contact method. Use more than one channel when the request changes payment, routing, pickup, or delivery details.
- Do not rely on a familiar display name or email address alone. The FBI/IC3 warns that “familiar names or email addresses alone do not confirm authenticity”.
- Record and check driver and vehicle details: driver’s license, vehicle make or description, license plate, cab and truck numbers, Department of Transportation (DOT) and motor-carrier numbers, and contact details.
- Watch for unauthorized loads posted in the company’s name, lookalike or free-email addresses, shortened or spoofed links, complaint-review lures, unexpected mailbox forwarding or deletion rules, and brief-use or internet-based phone numbers.
Respond quickly if an account or shipment may be compromised
- Notify the organization’s IT or security lead and the broker, carrier, or customer responsible for the shipment. If freight may be in transit, use an independently verified phone number to alert the parties handling pickup or delivery.
- Secure affected accounts: review active access, change credentials, revoke unauthorized sessions where available, and inspect mailbox forwarding and deletion rules. Check connected load-board accounts and other systems that use the same credentials.
- Preserve relevant emails, message headers, account activity, shipment records, and pickup details for investigation. Have IT assess affected devices and remove unauthorized software before returning them to service.
- Document the suspected fraudulent load or pickup and report cargo theft or attempted theft to the appropriate law-enforcement agency. Follow the organization’s incident-response process and any applicable reporting requirements.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
