TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Proofpoint Threat Insight

Freight Hacker Wields Code-Signing Service to Evade Defenses

2026-04-16 · Read original ↗

ATT&CK techniques detected

8 predictions
T1219Remote Access Tools
91%
“inside their deception platform, run using software built by deception pro, which creates a real - looking but synthetic active directory environment. the threat actor took the bait, believing the infection to be real, which allowed the researchers to monitor malicious activity, …”
T1566.001Spearphishing Attachment
68%
“when they sent firms in the industry a phishing message with a malicious attachment in the form of a visual basic script, proofpoint said. if executed, the vbs was designed to download and execute a second - stage powershell payload as well as to display " a decoy broker - carrie…”
T1566.001Spearphishing Attachment
60%
“##s with financially motivated theft, fraud and cargo diversion operations tied to transportation workflows, " not least because of attackers searching for credentials tied to " fuel card services, fleet payment platforms and freight brokerage systems, " the report says. the thre…”
T1566.002Spearphishing Link
58%
“detailed a phishing - as - a - service platform designed to target the sector that resulted in the theft of over 1, 600 unique login credentials. the researchers said the phishing platform appeared to have been developed by a russian - speaking coder and marketed on russian cyber…”
T1195Supply Chain Compromise
46%
“freight hacker wields code - signing service to evade defenses freight hacker wields code - signing service to evade defenses prolific threat actor focused on using malware to facilitate cargo theftcybercriminals don ' t hold up cargo trucks with a shotgun ; they hack transport a…”
T1566.002Spearphishing Link
42%
“##s with financially motivated theft, fraud and cargo diversion operations tied to transportation workflows, " not least because of attackers searching for credentials tied to " fuel card services, fleet payment platforms and freight brokerage systems, " the report says. the thre…”
T1059.001PowerShell
40%
“inside their deception platform, run using software built by deception pro, which creates a real - looking but synthetic active directory environment. the threat actor took the bait, believing the infection to be real, which allowed the researchers to monitor malicious activity, …”
T1219Remote Access Tools
36%
“s report. who ' s providing this signing service isn ' t clear. villadsen said it ' s probably distributed by word of mouth. in theory, an operating system should flag any piece of software signed using an invalid digital certificate. but because the attacker ' s installers and c…”