• Cyber cargo theft is surging as cyber gangs and organized cargo theft rings combine digital intrusions with real-world hijackings to steal high-value freight.
• Attackers weaponize remote monitoring and management (RMM) tools, broker load board fraud, and phishing to gain remote desktop control and quietly reroute shipments.
• Law enforcement, insurers, and logistics and trucking companies are racing to counter cyber-enabled cargo theft with tighter verification, multi-factor authentication, and new frameworks to reduce cargo crime.

Cyber cargo theft is becoming a concerning threat to global supply chains, as hackers and organized crime groups collaborate to steal cargo in transit. Recent findings reveal a significant rise in cyber-enabled heists, in which criminals use digital intrusions to facilitate real-world cargo theft. This report explores how cyber gangs operate, the scale of losses, and the measures being taken to combat this alarming trend.

For more news and analysis on safeguarding supply chains against such threats, explore our Supply Chain Security reporting.

Cyber Cargo Theft Surge: Overview

Criminals are blending phishing, stolen credentials, and remote access tools to hijack entire truckloads quietly.

Cargo theft has surged to record levels in recent years, aided by cybercrime tactics. A November 2025 report from Proofpoint showed that financially motivated hackers are teaming with traditional organized crime groups to steal massive amounts of cargo. These threat actors exploit security gaps in the transportation sector’s digital infrastructure, turning legitimate remote access tools into weapons for cargo hijacking.

Proofpoint observed nearly two dozen campaigns since mid-2025 in which trucking and logistics companies were compromised to facilitate theft of shipments. The criminals are not picky about targets – they opportunistically hit carriers of all sizes, from small family businesses to large freight firms. The unifying goal is financial gain through stealing cargo loads and selling the goods for profit, whether online or overseas.

This phenomenon represents a digital transformation of cargo theft, blending old-fashioned theft with new cyber techniques. Organized cargo theft is not new – it dates back to train robberies and mob-controlled trucking theft in past decades – but the digital angle is a modern twist. Digitalization in the industry has created new vulnerabilities that criminals eagerly exploit.

Enjoying our insights?

Subscribe to our newsletter to keep up with the latest industry trends and developments.

Stay Informed

The rise of online freight platforms and electronic records has opened the door to “strategic” or cyber-enabled theft, in which fraud and hacking are used to misdirect shipments. In other words, today’s cargo thief is as likely to wield a laptop as a crowbar, conducting fraud and network intrusions to achieve what once required physical stick-ups.

For the latest updates on cargo theft trends and prevention efforts, see our Cargo Theft coverage.

Cyber Gangs and Organized Heists: How It Works

Compromised broker load boards and fake freight listings are now front‑door entry points for strategic cargo theft.

So, how are cybercriminals stealing cargo? The schemes uncovered involve elaborate social engineering and abuse of remote access software. Attackers typically start by compromising a freight broker’s load board account – an online marketplace where trucking loads are listed and bid on. Once hackers take over a broker’s account (often through phishing or stolen credentials), they post a fraudulent load listing offering an attractive shipment.

When an unsuspecting trucking carrier or dispatcher responds to inquire or bid, the attackers spring the trap. They send a reply email containing a malicious link, often posing as a shipping document or agreement. If the victim clicks, it triggers a download of remote monitoring and management (RMM) software – but installed for nefarious purposes.

Using these RMM tools, the attackers quietly gain full remote access to the victim’s computer and network. From there, they conduct reconnaissance and steal any useful credentials or information. Attackers often deploy password-harvesting utilities to collect login details from web browsers and local credential stores.

Armed with internal access and passwords, the threat actor can then operate as if they were the trucking company or broker. They identify lucrative shipping loads and use compromised accounts to bid on or reroute them. In some cases, the criminals even intercept ongoing email threads – using previously hacked email accounts – to inject malicious instructions or links without raising suspicion.

This technique, known as thread hijacking, allows them to piggyback on existing trust between partners. In other instances, they send phishing emails directly to logistics companies, impersonating partners to trick targets into installing malware or RMM agents. All three methods lead to the same outcome: the attackers gain a foothold in the systems that coordinate freight movement. Once inside, the cyber gang’s “digital heist” moves to the physical world. The attackers use their access to scheduling and dispatch systems to divert valuable shipments to locations they control.

Rising loss values show thieves are increasingly selective, zeroing in on the highest‑value loads in the network.

For example, they can alter delivery instructions or impersonate dispatchers and drivers. One documented case showed hackers who, after compromising a carrier, deleted existing bookings, blocked the authentic dispatcher’s notifications, and then added their own agent’s contact information to coordinate new pickups.

The criminals essentially insert themselves into the supply chain. When a truck is dispatched for what the company thinks is a legitimate load, the attackers ensure that the freight is picked up by their own operatives or confederates instead. The result: the cargo vanishes from the legitimate route and is taken by the thieves.

Stolen goods have included everything from energy drinks to high-end electronics – anything that can be resold quickly for cash. After the heist, the loot is sold on black markets and e-commerce sites, or shipped overseas, netting profits for both the cybercriminals and their organized crime partners.

For additional insights into the challenges facing freight brokers, browse our Brokers section.

Role of Remote Monitoring Tools in Cargo Heists

A striking aspect of these campaigns is the abuse of legitimate remote IT tools. Threat actors are leveraging trusted Remote Monitoring and Management (RMM) software as their malware of choice. This trend aligns with a broader shift in cybercrime toward using RMM tools as first-stage payloads, as they can “fly under the radar” of security defenses.

Unlike custom malware, commercial RMM applications are expected in corporate environments and often digitally signed, making them less likely to trigger antivirus alerts. Criminals hide in plain sight by repurposing tools that IT admins use for support. In the 2025 cargo theft campaigns, multiple RMM platforms have been observed.

Legitimate remote monitoring tools have become one of the most effective weapons in modern cargo hijacking.

Not only did attackers use ScreenConnect (now ConnectWise Control) and SimpleHelp, but also platforms like Fleetdeck, GoTo Resolve (formerly LogMeIn), N‑able remote access tools, and PDQ Connect. Sometimes, the hackers even deploy RMM tools in tandem; for instance, a malicious PDQ Connect installer might fetch and install ScreenConnect and SimpleHelp together for redundancy. By installing these, the attackers get persistent remote desktop control of victim machines.

They can then move laterally through the company’s network, creating new accounts or using stolen credentials to access critical systems such as email, freight management portals, and document repositories. This covert access allows the thieves to monitor communications, impersonate employees, and execute fraudulent freight bookings without tipping off the victims until it’s too late. It’s worth noting that an earlier wave of malware-based intrusions preceded these RMM-focused attacks.

From 2024 through early 2025, hackers used information-stealing malware such as DanaBot, Lumma Stealer, NetSupport, and StealC to target transportation companies. DanaBot, for instance, is a banking Trojan used in botnets and linked to a Russia-based cybercrime operation, according to U.S. prosecutors. All these tools – whether stealthy RMM software or outright malware – serve the same core purpose: gain remote access to the target’s systems to facilitate data theft and unauthorized control. The increasing preference for RMM tools shows how cybercriminals innovate to evade detection, blurring the line between legitimate software and malware.

For further reporting on cybersecurity threats in the transportation sector, visit our Cybersecurity news page.

Organized Crime Collaboration and Global Impact

One insight from these cases is that cybercriminals are not acting alone – they are effectively the “IT department” for traditional organized crime rings. Analysts assess with high confidence that the hackers piloting these schemes are working closely with organized theft groups on the ground. The partnership makes sense: seasoned cargo thieves supply the logistics know-how and fencing networks for stolen goods. At the same time, cyber gangs possess the capabilities to infiltrate companies and reroute shipments.

U.S. law enforcement has long noted that much cargo theft is the work of organized criminal enterprises, and this new cyber-physical modus operandi is an evolution of that underworld activity. By teaming up, the two sets of criminals dramatically expand their reach – hackers can steal freight without ever setting foot in a warehouse, and organized thieves can source lucrative loads with insider access enabled by the hacks.

Cyber cargo theft is turning routine freight movements into high‑value targets for organized crime and hackers.

Globally, the impact is significant. Cargo theft is a multi-billion-dollar problem worldwide, and the rise of cyber tactics has helped fuel its growth. Hotspots for cargo theft span the globe, from North America to regions of Latin America, Europe, and Asia. Research has identified countries such as Brazil, Mexico, India, Germany, Chile, South Africa, and the U.S. as cargo theft hotspots.

In Mexico, for example, cargo hijackings (often violent) have been a persistent issue, and the added element of cyber fraud is another challenge for authorities. In Canada, freight theft incidents are likewise on the radar; in fact, the U.S. and Canada together recorded thousands of cargo theft cases in 2024, with a double-digit percentage increase from 2023. Thieves in North America have become increasingly selective, targeting high-value shipments such as electronics and pharmaceuticals, as well as commodities like copper at record prices.

Data from 2025 shows that the average value of a stolen load has roughly doubled from the prior year, exceeding $330,000 per incident, as criminals targeted only the most profitable freight. This suggests that organized groups are refining their tactics – using intel (often gleaned via cyber means) to single out shipments that promise big payoffs. It’s important to emphasize that not every cargo theft now involves a hacker; many thefts are still “straight” physical heists, such as stealing unattended trailers or warehouse burglaries.

But the strategic theft category – which includes fraud, identity theft, fictitious pickups, and broker scams – is the fastest-growing slice. Cyber-enabled schemes fall under this umbrella of strategic theft. Criminal groups have found that using phishing, fake websites, and account takeovers can significantly increase the success rate of their heists by bypassing traditional security and exploiting trust within the logistics system.

The FBI warns that cyber cargo theft often begins with basic cyberattacks, such as phishing emails delivering Trojans, to steal login credentials or dispatch documents, which are then used to pull off fictitious pickups or misdirect loads. The result is the same: cargo disappears into the criminal supply chain, leaving the victims with empty trailers and multimillion-dollar losses.

To learn more about freight fraud schemes and how to prevent them, read our Fraud coverage.

Top Targeted Commodities and Loss Snapshot (2024–2025)

Law Enforcement and Industry Responses to Cargo Theft

Law enforcement and regulators are racing to close gaps exploited by double‑brokering, fake carriers, and freight fraud.

The spike in cyber-facilitated cargo theft has not gone unnoticed by authorities and industry leaders. In the United States, cargo theft is now considered a national concern, costing the economy tens of billions of dollars annually. The National Insurance Crime Bureau (NICB) estimates annual losses from cargo theft at around $35 billion when factoring in all direct and indirect costs.

In 2024, theft tracking networks recorded an all-time high in incidents, and 2025 is on pace to be even worse. U.S. federal agencies are ramping up efforts to counter this threat. The Department of Transportation (DOT) issued a public Request for Information (RFI) in late 2025 seeking input on strategies to reduce cargo theft.

The DOT is looking to close regulatory loopholes that crooks exploit – such as fraudulent carrier identities and double-brokering scams, in which a disreputable broker hands off a load to thieves.

For a deeper look at the rise of double-brokering scams and their impact on the industry, check out our Double Brokering reports.

The agency is also encouraging better coordination between the DOT, FBI, and state/local law enforcement to improve detection and response to cargo theft rings. Law enforcement agencies, including the FBI, have been actively investigating these hybrid crimes. FBI task forces focused on transnational organized crime are partnering with industry groups to identify patterns of cyber theft. When cases meet federal thresholds – for example, large dollar values or multi-state operations – the FBI can step in with resources and intelligence sharing.

Recent years have seen notable prosecutions for cargo theft, including rings targeting high-value goods and fictitious pickup schemes. However, prosecuting these cases can be complex. Criminals often operate across borders – a load might be stolen in the U.S., driven to Mexico, and then containerized and shipped abroad, complicating jurisdiction. Cyber aspects add another layer of anonymity, as hackers may be overseas or operating through layers of proxies and compromised infrastructure.

There is evidence that some transportation‑sector malware campaigns have involved tools such as DanaBot, a banking Trojan that U.S. prosecutors say is operated by a Russia‑based cybercrime organization. The cross‑border nature of this infrastructure creates diplomatic challenges for prosecution and can slow enforcement. In parallel, industry organizations are responding by raising awareness and developing best‑practice frameworks to help carriers and brokers harden their defenses.

The National Motor Freight Traffic Association is pushing carriers to tighten processes against both physical and cyber intrusion.

The National Motor Freight Traffic Association (NMFTA), for instance, has published a Cargo Crime Reduction Framework to help carriers harden their processes against both physical and cyber intrusion.

Stay abreast of the latest developments affecting motor carriers, including safety and security, by visiting our Motor Carriers news hub.

Security professionals stress the basics of cyber hygiene as a defense: phishing and smishing campaigns, as well as business email compromises, remain the number one entry points. Companies are urged to train employees on these social engineering tactics and to verify communications, especially any that request software installation, credential sharing, or unusual routing changes.

Using multi-factor authentication and strict access controls on load board and broker accounts can prevent many account takeovers. Some freight brokers and load board providers are also enhancing their platform security, looking for signs of bot activity or suspicious postings. On the technology side, the Cybersecurity and Infrastructure Security Agency (CISA) in the U.S. has recognized the risks posed by the misuse of RMM tools.

Cyber defense plans for RMM software have been published to help vendors and critical infrastructure operators secure these tools. RMM software companies have begun working with authorities to implement code-signing and authentication improvements and to provide security teams with ways to distinguish legitimate use from abuse. Vendors have urged customers to restrict public-facing access, enforce strong authentication, and monitor for anomalous remote sessions. The goal is to prevent threat actors from easily weaponizing IT tools against unsuspecting businesses.

Protecting Supply Chains: Best Practices and Outlook

Cyber‑enabled theft turns dispatch systems and email threads into tools for rerouting freight without raising alarms.

From a risk management perspective, logistics and trucking companies are tightening protocols to guard against cargo theft.

For more on freight security initiatives and best practices across the industry, browse our Freight Security section.

The NICB recommends a multi-layered approach that combines both cyber and physical security measures. Key best practices include thorough background screening of employees and business partners, since insider collusion or fake carrier identities often play a role. Training staff is crucial – dispatchers and drivers should be taught to spot red flags, such as unsolicited links or unusual pickup instructions, and to verify any changes through secondary channels.

Leaders in the sector stress that criminals exploit weaknesses in everyday business tech. Weaknesses in common-use technologies like VoIP and GPS, coupled with business email compromise, identity theft, and synthetic identities, enable sophisticated criminals to reroute high-value goods to the black market. This means companies must also secure their communications – for example, verifying that phone numbers and emails actually belong to known partners, and not blindly trusting caller ID, since VoIP can spoof identities.

When it comes to online load boards and freight platforms, increased vigilance is required. Companies are encouraged to exercise due diligence to verify the identity of anyone they contract with through online boards. Carriers should independently confirm load details with the broker or shipper using known contacts, especially if a deal seems too good to be true or if any aspect raises suspicion, such as last-minute changes to pickup locations or payment terms.

To dive deeper into best practices for using load boards securely and avoiding scams, follow our Load Board updates.

Implementing technical controls can also help. Companies are now restricting downloads of RMM tools – if a firm doesn’t use a particular remote support software, it should consider blocking its installation or execution on company devices. Network monitoring for unusual remote access sessions can also catch an attack in progress; for instance, if a rarely used tool suddenly initiates connections at odd hours, security teams should investigate.

From a risk management perspective, logistics and trucking companies are tightening protocols to guard against cargo theft.

Keeping systems patched and updated will deter some malware-based intrusions, and leveraging threat intelligence from recent reports can enable companies to filter or flag malicious emails before they reach employees. Despite these efforts, experts caution that the lucrative nature of cargo theft means the threat is likely to persist or even escalate. Organized criminal groups have shown adaptability – when security improves in one area, they find another weakness.

Organizations that track theft trends predict that social engineering scams targeting logistics – such as using publicly available load data to identify targets – will become even more prevalent. The busy holiday shipping season and ongoing supply chain pressures provide criminals with more cover to strike. Additionally, economic factors, such as high resale prices for certain goods (e.g., electronics or copper), drive thieves to take bolder actions.

The cross-border aspect adds complexity: a stolen truckload might quickly be driven into Mexico or Canada, beyond the immediate reach of U.S. authorities, or containers of stolen goods might be mixed into legitimate exports. This global dimension means that international cooperation among law enforcement agencies is increasingly essential for cracking down on major theft rings.

Logistics professionals are advised to stay vigilant, invest in security training, and collaborate with industry watchdogs and law enforcement. By understanding how these cyber cargo thefts unfold and implementing proactive safeguards, the transportation sector can better defend itself against this modern wave of cargo crime.

Stay informed about the strategies in logistics management addressing these challenges by exploring our Logistics Management insights.

What Are RMM Tools in Cargo Theft Schemes?

Remote Monitoring and Management (RMM) tools are legitimate software applications used by IT professionals to access and manage computers and networks remotely. In cargo theft schemes, hackers misuse these tools by tricking trucking or broker employees into installing them via phishing links. Once installed, an RMM tool – such as ScreenConnect, LogMeIn, or N-able – gives the attacker remote desktop control as if they were an authorized user. This allows cybercriminals to snoop around the system, steal passwords, and eventually take actions such as booking or rerouting freight.

Attackers favor RMM tools because they are less likely to be flagged as malware – they are often digitally signed and widely used programs. Essentially, the hackers hide behind the credibility of these IT tools to maintain persistence in a victim’s network without detection. For a defender, one challenge is that the presence of an RMM tool on an employee’s machine might not immediately appear suspicious if that company commonly uses remote support software.

The lucrative nature of cargo theft means criminals will keep probing for weak yards and poorly secured equipment.

Distinguishing between legitimate use and malicious use becomes critical. Some security measures to detect abuse include monitoring for RMM installations that were not pushed by the IT team, and alerting on remote sessions originating from unknown IP addresses or at unusual times. In short, RMM tools in these schemes serve as a backdoor into a company’s systems, enabling thieves to execute their cargo heist with minimal footprints.

How Big Is the Cargo Theft Threat in 2025?

By all accounts, the cargo theft threat in 2025 is at an alarming high, with both frequency and financial impact increasing. In the first half of 2025, reported cargo theft incidents in the U.S. rose noticeably compared to the same period in 2024.

The National Insurance Crime Bureau noted that 2024 saw a sharp spike in cargo thefts from the prior year, reaching the highest levels on record, and that losses were projected to rise further in 2025. For the first time, the value of goods stolen in a single year in the U.S. exceeded $1 billion, based on combined insurance and law enforcement data. Specific regions, such as California, Texas, and Florida, remain hotspots for cargo theft, but the problem truly spans coast to coast.
“From the comfort of their own home or overseas, a criminal can use voice over internet protocol (VoIP), GPS and a synthetic ID.” — Robert Bornstein, Cargo Theft Program Director, NICB
In 2025, some quarterly analyses showed that thieves were becoming more selective but still rampant. For example, in one quarter, the total value of stolen goods in North America was estimated at hundreds of millions of dollars. High-value electronics, computer components, pharmaceuticals, apparel, and even food and beverage products are among the most commonly stolen, given their resale value and ease of offloading. Beyond the raw numbers, what makes the current trend especially worrisome is the strategic, organized nature of these thefts.

Criminal enterprises treat cargo theft as big business, often using data analytics to pick targets – and, as explored above, now using cyber tools to facilitate the crimes. The economic toll extends beyond lost goods: companies suffer supply-line disruptions, insurers raise premiums (or even exclude coverage for theft of certain goods), and consumers may see higher prices as businesses pass on the costs of losses.

At the water’s edge, port security is the last line of defense between organized cargo crime and the global supply chain.

During the COVID-19 pandemic, when supply chains were strained, cargo theft became even more tempting, exploiting chaos at ports, yards, and warehouses. That focus has not subsided; if anything, the success of recent cyber-cargo schemes has emboldened thieves.

The outlook for 2025 and beyond suggests that without concerted action – improved security protocols, better information sharing, and stricter enforcement – cargo theft will remain a lucrative convergence of cybercrime and organized crime. Logistics professionals who understand the evolving threat landscape, invest in robust cyber and physical security, and strengthen collaboration with partners and authorities will be best positioned to reduce their exposure to cyber cargo theft in the years ahead.

Key Developments in Cyber Cargo Theft and Organized Cargo Crime

• Cyber cargo theft has evolved into a strategic theft category, blending cyber-enabled heists with traditional organized cargo theft networks.
• Criminals increasingly start with phishing emails delivering Trojans and business email compromise to gain access to freight brokers’ load board accounts.
• Remote monitoring and management tools such as ScreenConnect, SimpleHelp, GoTo Resolve, N-able, and PDQ Connect are abused to achieve persistent remote desktop control.
• Attackers use password-harvesting utilities and compromised accounts to impersonate dispatchers, drivers, and brokers, enabling fictitious pickups and misdirected loads.
• Average cargo loss values have risen sharply as thieves selectively target high-value shipments, including electronics, pharmaceuticals, and copper.
• Cyber-facilitated cargo theft is increasingly cross-border, with stolen freight and criminal supply chains touching the United States, Mexico, Canada, and other global hotspots.
• U.S. authorities, including the Department of Transportation, FBI, and NICB, are focusing on double-brokering scams, fraudulent carrier identities, and organized crime rings.
• Logistics and trucking companies are responding with stronger cyber hygiene, multi-factor authentication, tighter control over online load boards, and adoption of cargo crime reduction frameworks.

Additional External Resources on Cyber Cargo Theft and Security

• Review detailed threat research on how RMM tools are abused against trucking and logistics in Proofpoint’s report, “Remote access, real cargo: cybercriminals targeting trucking and logistics.”
• Explore national statistics, trends, and prevention guidance on cargo theft at the National Insurance Crime Bureau’s Cargo Theft overview page.
• Read the NICB news release, “NICB Warns of Increased Cargo Theft in 2025,” for data on recent year‑over‑year spikes and projected losses.
• See how the U.S. Department of Transportation is framing the issue in its policy work at “Multimodal Freight—Cargo Theft.”
• Examine the DOT’s formal policy request in “Protecting America’s Supply Chain from Cargo Theft – Request for Information.”
• Get an official law‑enforcement perspective on the scope and typology of cargo crimes at the FBI’s Cargo Theft page.
• Download the National Motor Freight Traffic Association’s Cybersecurity Cargo Crime Reduction Framework for practical controls against identity spoofing, freight fraud, and digital cargo theft.
• Consult CISA’s Joint Cyber Defense Collaborative document, Remote Monitoring & Management Cyber Defense Plan, for federal guidance on securing RMM tools used across critical infrastructure.