Beyond the breach: inside a cargo theft actor's post-compromise playbook

A cargo theft threat actor maintained access to a decoy environment for over a month, providing extensive visibility into post-compromise operations. The attacker established redundant persistence using multiple remote access tools, including four ScreenConnect instances, Pulseway RMM, and SimpleHelp RMM. A previously unknown signing-as-a-service capability was employed to evade detection by re-signing ScreenConnect installers with fraudulent code-signing certificates. Extensive reconnaissance targeted financial platforms, payment systems, cryptocurrency wallets, and transportation-specific services including fuel card providers, fleet payment platforms, and load board operators. The activity strongly aligns with financially motivated crimes against the transportation industry, including freight diversion and cargo theft operations.

• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)Malware2026-10-08
• Fake "View & Sign" and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect ClientsMalware2026-10-29
• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07