Proofpoint Details Cargo-Theft Actor’s Post-Compromise Playbook

Apr 16, 2026 · Original article ↗

Summary

Proofpoint observed a cargo-theft actor in a decoy environment for over a month, using multiple remote management tools and a third-party signing service for persistence while conducting reconnaissance for financial and transportation-related access.

Key points

Proofpoint observed the activity in a Deception.pro decoy environment after executing a malicious payload in late February 2026; the environment did not represent a transportation carrier.
The actor used a compromised load board and email to deliver a VBS payload that launched PowerShell and installed ScreenConnect.
The actor installed four ScreenConnect instances, Pulseway, and SimpleHelp, creating redundancy for remote access.
A PowerShell deployment chain used a third-party signing service to re-sign ScreenConnect installers and components with a fraudulent but valid certificate, replacing binaries signed with revoked certificates. Researchers collaborated to revoke the certificate.
At least 13 PowerShell scripts searched browser histories and databases for financial, payment, logistics, and fleet-service access, and sent reconnaissance results to attacker-controlled Telegram bots.
The actor manually accessed PayPal and ran a binary designed to find browser and desktop cryptocurrency wallets; Proofpoint assessed the targeting as likely intended to support financial fraud and cargo theft.
Proofpoint recommends monitoring for unauthorized remote management tools, suspicious PowerShell activity, and abnormal browser telemetry related to financial platforms.

Article Details

Attack Vectors: The actor compromised a load board platform and emailed transportation carriers a malicious VBS payload in response to fraudulent advertised loads.
The VBS payload downloaded and executed PowerShell, installed ScreenConnect, and displayed a decoy broker-carrier agreement.
The actor installed four ScreenConnect instances, Pulseway, and SimpleHelp to maintain redundant remote access.
A PowerShell workflow used a third-party signing service and a fraudulent but valid Authenticode certificate to re-sign ScreenConnect installers and components.
PowerShell scripts enumerated users and browser profiles, examined browser history and databases, and searched for financial and transportation-related access.
The actor executed a cryptocurrency-wallet-stealer binary and sent positive findings to attacker-controlled Telegram bots.
Defensive Notes: Monitor for unauthorized remote management tools and suspicious PowerShell activity.
Monitor for abnormal browser telemetry associated with access to financial platforms.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`nq251os[.]top`	ScreenConnect C2 domain listed among the article's indicators.
DOMAIN	`officcee404[.]com`	Domain listed among indicators associated with the intrusion.
DOMAIN	`screlay[.]amtechcomputers[.]net`	ScreenConnect C2 domain identified in the article's indicators.
DOMAIN	`signer[.]bulbcentral[.]com`	Signing-service domain used in the malicious workflow to re-sign ScreenConnect installers and components.
HOSTNAME	`af124i1agga[.]anondns[.]net`	Hostname listed among indicators associated with the intrusion.
HOSTNAME	`services-sc-files[.]s3[.]us-east-2[.]amazonaws[.]com`	Signer-controlled host used to deliver the newly signed MSI and ScreenConnect component archive.
IPV4	`147[.]45[.]218[.]0`	IP address identified as related to SimpleHelp C2.
SHA256	`1f89a432471ec2efe58df788c576007d6782bbdf5b572a5fbf5da40df536c9f5`	SHA-256 hash identified for the malicious VBS payload.
SHA256	`3dcb89430bae8d89b9879da192351506f4fdb7c67e253a27f58b3bf52101cd4c`	SHA-256 hash identified for a PowerShell script used in the intrusion.
SHA256	`82d603c0b387116b7effdee6f361ca982c188de0c208e681e942300a0139c03f`	SHA-256 hash identified for the cryptocurrency wallet stealer.
SHA256	`b861e3682ca3326d6b29561e4b11f930f4a9f10e9588a3d48b09aa6c36a8ea80`	SHA-256 hash listed alongside SimpleHelp indicators.
SHA256	`d9832d9208b2c4a34cf5220b1ebaf11f0425cf638ac67bf4669b11c80e460f58`	SHA-256 hash listed for Pulseway RMM in the article's indicators.
SHA256	`f4977bfeae2a957add1aaf01804d2de2a5a5f9f1338f719db661ac4f53528747`	SHA-256 hash identified for ScreenConnect tooling used in the intrusion.
URL	`hxxps[:]//carrier-packets-docs[.]com/FREEDOM_FREIGHT_SERVICES_CARRIERS_ONBOARDING.vbs`	VBS payload staging URL identified as malicious.
URL	`hxxps[:]//qto12q[.]top/pdf.ps1`	PowerShell payload staging URL identified as malicious.