GoKawiilWritten by Ben Wilkens, director of cybersecurity, NMFTA
Working in cybersecurity, you are well aware of the playbook that ransomware operators use. Stolen credentials, established persistence, network recon, pivoting to a high-value target cash out. These techniques are well documented; we have attack frameworks and well-documented kill chains for their techniques. What you may not have been exposed to is that same playbook being used to steal freight.
Entire truckloads of goods are re-routed, disappearing from the legitimate logistics ecosystem and reappearing on the black market. Bottled water, eggs, crab legs, energy drinks, Legos, sneakers, pharmaceuticals, pistachios, you name it, it’s been stolen by organized criminals taking the ransomware playbook and applying it to the transportation industry for different purposes.
In 2025, Verisk CargoNet reported approximately $725 million in cargo crime losses across North America. The FBI internet Crime Complaint Center (IC3) reported roughly 21 billion in cybercrime losses for the same period. While these two numbers are each staggering in their own right, they only represent reported losses.
Too often stolen freight and cyberattacks both go unreported, especially when suffered by private companies on the smaller end of the size spectrum. These two numbers also are increasingly part of the same conversation.
The cargo losses we are seeing in the transportation sector are not the result of movie-style hijackings by armed marauders. They are the result of a successful phishing email that results in a fraudulent pickup of a load of pharmaceuticals by a truck destined for a criminal warehouse. Industry estimates indicate that the majority of cargo crime in the United States now involves a cyber-enabled component.
For a security community that is used to thinking of stolen goods and cargo crime as a physical security issue, this issue is forcing a paradigm shift. These threat actors are sophisticated. Many of them are in fact international organized crime groups operating from outside the United States.
Their techniques are immediately recognizable to anyone who has been involved in incident response related to traditional cybercrime.
A Familiar Kill Chain
A walk through of a typical cyber-enabled cargo crime starts the same way as many other cybercrimes; Reconnaissance. Public sources such as United States Department of Transportation (USDOT) numbers, Federal Motor Carrier Safety Administration (FMCSA) registry information, motor carrier (MC) numbers, insurance details and employees are all researched.
... continue reading