Cargo Theft Actor Exploits Load Boards for Extended Operations

• •Threat actor maintained access in a decoy environment for over a month.
• •Malicious VBS payload delivered via email to transportation carriers.
• •Actor focused on reconnaissance of financial systems and transportation entities.

In late February 2026, Proofpoint researchers observed a threat actor targeting transportation organizations within a controlled decoy environment for over a month. This actor, previously linked to cargo theft and freight fraud, utilized a malicious Visual Basic Script (VBS) payload delivered via email to transportation carriers. The attack focused on compromised load board platforms, which connect shippers and freight brokers to motor carriers. The actor maintained access through multiple remote management tools, indicating a sophisticated approach to persistence and redundancy. Their reconnaissance efforts targeted financial access and transportation-related entities, suggesting plans for further crimes against the industry. This engagement provided unprecedented insights into the actor's post-compromise behavior and decision-making processes. The incident highlights ongoing vulnerabilities in the transportation sector that could facilitate significant financial fraud.