Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Cybercriminals are targeting trucking and logistics companies to steal cargo freight through elaborate attack chains. They compromise companies and use their access to bid on cargo shipments, which they then steal and sell. The threat actors typically deliver remote monitoring and management (RMM) tools as a first-stage payload. This cyber-enabled theft is part of a multi-million-dollar criminal enterprise that has increased due to digital transformation. The attackers use tactics such as compromising load boards, email thread hijacking, and direct targeting via email campaigns. They deliver RMM tools like ScreenConnect, SimpleHelp, and PDQ Connect, which grant full control of compromised machines. The activity has been observed since at least June 2025, with nearly two dozen campaigns in the last two months alone.

This threat involves cybercriminal groups targeting trucking and logistics companies to facilitate cargo theft through sophisticated cyberattack chains. The attackers initially compromise victim organizations by delivering remote monitoring and management (RMM) tools such as ScreenConnect, SimpleHelp, PDQ Connect, LogMeIn Resolve, and others as first-stage payloads. These tools provide attackers with persistent, full remote control over compromised systems, enabling them to manipulate shipment bids and logistics operations. Attack vectors include phishing campaigns, email thread hijacking, and compromising load boards—platforms used to post and bid on freight shipments. By gaining access to internal systems, attackers can place fraudulent bids on cargo shipments, redirect or steal the physical freight, and subsequently sell it on illicit markets. This cyber-enabled theft leverages digital transformation trends in logistics, where increased reliance on remote access and digital platforms has expanded the attack surface. The campaigns have been active since mid-2025, with nearly two dozen observed in the last two months, indicating an escalation. The attackers employ a combination of social engineering, supply chain exploitation, and advanced remote access tools to maintain stealth and persistence. While no known public exploits exist for specific vulnerabilities, the threat relies heavily on user interaction and social engineering to deploy RMM tools. The medium severity rating reflects the significant financial and operational impact on affected companies, though the attack requires targeted access and some level of user involvement.

Detailed information about Remote access, real cargo: cybercriminals targeting trucking and logistics. Get real-time updates, technical details, and mitigation 

Remote access, real cargo: cybercriminals targeting trucking and logistics - Live Threat Intelligence - Threat Radar | OffSeq.com

Remote access, real cargo: cybercriminals targeting trucking and logistics

A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazilian electronic invoice system (NF-e) as bait, leading victims to malicious content on Dropbox. The threat actor, likely an initial access broker, abuses free trial periods of RMM tools to gain complete control of target machines. The campaign's objective is to create a network of compromised machines for potential sale to third parties, including ransomware operators and state-sponsored actors. The abuse of commercial RMM tools is increasing due to their digital signatures, full backdoor capabilities, and low cost.

This threat involves a spam campaign primarily targeting Brazilian users, with a focus on high-value targets such as C-level executives and financial or HR personnel. The attackers exploit commercial Remote Monitoring and Management (RMM) tools, specifically PDQ Connect and N-able remote access tools, to gain unauthorized access to victim machines. The campaign uses the Brazilian electronic invoice system (NF-e) as a lure, directing victims to malicious content hosted on Dropbox. The attackers leverage free trial periods of these RMM tools to establish persistent, fully backdoored access to compromised systems. These RMM tools are attractive to attackers because they are digitally signed, which helps evade detection, and provide comprehensive remote control capabilities. The ultimate goal of the campaign is to build a network of compromised machines that can be sold to third parties, including ransomware operators and state-sponsored threat actors. The campaign employs multiple tactics and techniques such as initial access brokering, social engineering via spam, and abuse of legitimate software to bypass security controls. Although the campaign is currently focused on Brazil, the abuse of RMM tools is a growing trend globally due to their stealth and effectiveness in establishing long-term access.

Detailed information about Spam campaign targeting Brazil abuses Remote Monitoring and Management tools. Get real-time updates, technical details, and mitigatio

Title	Severity	Type	Source	Date

Threats Tagged 'pdq connect'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'pdq connect'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility