Don't Let Cyber Thieves Steal Your Next Load

Digital manipulation, fake pickup requests, and identity hijacking are on the rise. NMFTA’s Cybersecurity Cargo Crime Reduction Framework is here to help you to understanding how modern cargo theft works. Don't wait for a costly breach, download to take immediate action and safeguard your assets.

PLUS: Download the free Vendor Risk Assessment Framework and get a practical checklist and scoring model to evaluate, onboard, and monitor third-party vendors.

Table of Contents

Cyberthreat Analysis

• Remote Access, Real Cargo: Cybercriminal Targeting Trucking and Logistics
• GlassWorm Self-Propagating VSCode Extension Worm
• Ransomware and Cyber Extortion in Q3
• SesameOp: Novel Backdoor Uses OpenAI Assistants API for Command and Control

Industry News

#NMFTACyber On Demand

Remote Access, Real Cargo: Cybercriminals Targeting Trucking and Logistics

Proofpoint is tracking a cluster of cybercriminal activity that targets trucking and logistics companies and infects them with remote monitoring and management (RMM) tooling for financial gain. Based on their ongoing investigations paired with open-source information, Proofpoint assesses with high confidence that the threat actors are working with organized crime groups to compromise entities in the surface transportation industry—in particular trucking carriers and freight brokers—to hijack cargo freight, leading to the theft of physical goods. The stolen cargo most likely is sold online or shipped overseas. Such crimes can create massive disruptions to supply chains and cost companies millions, with criminals stealing everything from energy drinks to electronics.  

In the observed campaigns, threat actors aim to infiltrate companies and use their fraudulent access to bid on real shipments of goods to ultimately steal them. The observed campaigns described in this report are similar to activity Proofpoint researchers previously detailed in September 2024. However, they cannot assess with high confidence whether historic and current campaigns are conducted by the same or multiple groups; thus, Proofpoint is not attributing the activity to a tracked threat actor.

GlassWorm Self-Propagating VSCode Extension Worm

GlassWorm is the first self-propagating worm targeting VS Code extensions on OpenVSX marketplace. The attack uses invisible Unicode characters to hide malicious code from code editors and review processes, combined with blockchain-based command and control infrastructure on the Solana blockchain that cannot be taken down.

Seven OpenVSX extensions were compromised on October 17, 2025, with 35,800 total downloads, and ten extensions were still actively distributing malware two days later. The malware harvests NPM, GitHub, and Git credentials, targets 49 different cryptocurrency wallet extensions, deploys SOCKS proxy servers turning developer machines into criminal infrastructure, and installs hidden VNC servers for complete remote access. The stolen credentials are used to automatically compromise additional packages and extensions, creating exponential spread through the developer ecosystem. It uses Google Calendar as backup C2 server. This means Glassworm is using a triple layer C2 set up with the Solana blockchain, the use of a direct IP connection and Google Calendar, making it very robust.

Ransomware and Cyber Extortion in Q3 2025

Ransomware threats reached a tipping point in Q3 2025, driven by major developments across the ecosystem. The hacking collective “Scattered Spider” teased its first ransomware-as-a-service (RaaS) offering, while long-standing ransomware operator “LockBit” announced its intent to target critical infrastructure through its new affiliate program. Meanwhile, a powerful alliance between leading ransomware groups has raised the stakes for organizations worldwide. Adding to the tumult, the number of data-leak sites hit a record high, with emerging groups expanding into new regions and industries.  

While the number of organizations listed on data-leak sites for extortion remained steady compared to Q2 2025, this quarter was defined by significant developments reshaping the ransomware ecosystem. 

• Scattered Spider teases its first RaaS: “ShinySp1d3r RaaS” marks the first major RaaS from English-speaking cybercriminals;
• LockBit eyes critical infrastructure: LockBit releases its “LockBit 5.0” affiliate program, allowing affiliates to target sectors typically off-limits under RaaS rules;
• New alliances between ransomware giants: “DragonForce,” “Qilin,” and LockBit form a partnership poised to escalate attacks; and
• Ransomware spreads globally: The number of active data-leak sites hit an all-time high of 81, driving attacks into new regions like Thailand, which saw a 69% surge in listings fueled by the newly emerged “Devman2” group.

The ransomware threat has reached unprecedented levels—with a record number of data-leak sites, major collaborations, and expansion by emerging groups putting organizations across all industries and regions at risk. This report highlights the critical shifts in ransomware every CISO must know. 

SesameOp: Novel Backdoor Uses OpenAI Assistants API for Command and Control

Microsoft Incident Response – Detection and Response Team (DART) researchers uncovered a new backdoor that is notable for its novel use of the OpenAI Assistants Application Programming Interface (API) as a mechanism for command-and-control (C2) communications. Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as a way to stealthily communicate and orchestrate malicious activities within the compromised environment. To do this, a component of the backdoor uses the OpenAI Assistants API as a storage or relay mechanism to fetch commands, which the malware then runs.

The backdoor, which Microsoft named SesameOp, was discovered in July 2025, when DART researchers responded to a sophisticated security incident, where the threat actors had maintained a presence within the environment for several months prior to the engagement. The investigation uncovered a complex arrangement of internal web shells, which were responsible for running commands relayed from persistent, strategically placed malicious processes. These processes leveraged multiple Microsoft Visual Studio utilities that had been compromised with malicious libraries, a defense evasion method known as .NET AppDomainManager injection.

Hunting across other Visual Studio utilities loading unusual libraries led to the discovery of additional files that could facilitate external communications with the internal web shell structure. Analysis of one such artifact identified SesameOp, a covert backdoor purpose-built to maintain persistence and allow a threat actor to stealthily manage compromised devices. The stealthy nature of SesameOp is consistent with the objective of the attack, which was determined to be long term-persistence for espionage-type purposes.

This blog post outlines our analysis of SesameOp and its inner workings and highlights the capability of threat actors to adjust their tactics, techniques, and procedures (TTPs) in response to rapid technological developments. We’re sharing these findings with the broader security research community to help disrupt this backdoor and improve defenses against this and similar threats.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!