Proofpoint researchers recently shared visibility into a financially motivated threat actor targeting the trucking and logistics sector. Proofpoint researchers detonated the crime group’s payload in a specialized decoy environment. After compromising a load board platform and sending a malicious VBS file masquerading as broker and carrier paperwork, the attackers deployed several remote management tools, including four (4) ScreenConnect instances as well as Pulseway and SimpleHelp, to maintain redundant, long-term access. A key discovery was a “signing-as-a-service” scheme: via PowerShell, the actor fetched a ScreenConnect installer from their own infrastructure, sent it to an external signing service, then downloaded a re-signed MSI and binaries bearing a valid (but fraudulent) Sectigo code-signing certificate. This allowed them to replace revoked vendor-signed components and maintain trusted, stealthy remote access despite ScreenConnect’s certificate revocations. With persistence in place, the next step in the campaign was for the threat actor to conduct hands-on-keyboard activity: accessing PayPal in the browser, running a PyInstaller tool to locate browser and desktop crypto wallets, and executing at least thirteen (13) PowerShell scripts to mine browser histories and SQLite databases for banking, money transfer, accounting, fleet fuel card, load board, and freight brokerage access. Results were funneled to Telegram for operator review. The operation shows deep knowledge of transportation workflows and intent to enable both cargo theft and broader financial fraud. It also highlights a growing criminal trend of abusing legitimate trust mechanisms (code signing, RMM tools). CTIX Analysts recommend that transport and logistics firms monitor for unauthorized RMM, suspicious PowerShell use, and abnormal access to financial and freight platforms. Please find relevant IOCs in the Proofpoint report linked below. CTIX will continue to provide timely reporting of relevant and ongoing threat actor activities.