Cargo thieving hackers running sophisticated remote access campaigns, researchers find

Proofpoint researchers observed cybercriminals compromising load boards to deploy multiple remote access tools (including several ScreenConnect instances) against trucking carriers, using a novel "signing-as-a-service" to sign installers and re-sign components to evade detection and maintain persistence; attackers also scanned infected systems for cryptocurrency wallets, PayPal and banking credentials, fuel card and freight management platforms to enable cargo theft and broader financial fraud against mostly small carriers.