eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Cybercriminals Targeting Trucking and Logistics
Bottom Line: Details have emerged on a campaign targeting trucking and logistics organizations within North America, where threat actors are using social engineering tactics to obtain access to organizations to enable the theft of cargo shipments, blending cyber and physical crime.
Proofpoint researchers have uncovered a coordinated cybercriminal campaign targeting the surface transportation industry, with a particular focus on trucking carriers and freight brokers. In this activity, threat actors are leveraging Remote Monitoring and Management (RMM) tools to gain unauthorized access to logistics companies. Their ultimate goal is to steal physical cargo by fraudulently bidding on shipments and redirecting them for resale. The activity appears to be linked to organized crime groups and reflects the convergence of cyber compromise and real-world physical theft, resulting in direct financial losses and supply-chain disruption.
Threat actors are targeting trucking and logistics companies with the intent to steal physical cargo. They gain access to logistics systems and impersonate legitimate carriers to intercept shipments. The initial access is often achieved through phishing emails or compromised load board accounts. In some cases, attackers hijack email threads to insert malicious URLs that lead to the download of RMM software. These payloads are typically delivered as executable or MSI files, which are often signed to appear trustworthy and evade detection. The attackers use legitimate RMM tools such as ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve to maintain persistent access to compromised systems. Once inside the network, they conduct reconnaissance to identify valuable systems and data. They use credential harvesting tools such as WebBrowserPassView to collect login information.
One notable case described in the report detailed a Reddit post about an attacker who gained access to a company through RMM delivery, deleted existing bookings, disabled dispatcher notifications, added their own device to the dispatcher’s phone extension, booked loads under the compromised carrier’s name, and coordinated the transport.
Proofpoint has observed nearly two dozen distinct campaigns since August 2025, although the activity dates back to at least January 2025. While the campaigns are primarily focused on North America, cargo theft is a global issue, with notable activity in Brazil, Mexico, India, Germany, and South Africa.
eSentire Threat Intelligence Analysis:
This campaign highlights a clear shift where digital compromise is being operationalized to facilitate real-world physical theft. Unlike typical financially motivated campaigns that rely on ransomware or data theft, adversaries leverage remote access to directly manipulate freight operations and steal tangible goods. This demonstrates that cyber intrusions now have immediate physical consequences, expanding the threat landscape beyond digital loss.
The campaign reveals that adversaries understand logistics workflows, freight broker–carrier relationships, and load-board processes. This knowledge allows them to craft more convincing lures, infiltrate relevant platforms, and select valuable shipments. Organizations are advised to strengthen defenses through a combination of user education and technical controls. Conducting Phishing Security and Awareness Training (PSAT) can help employees recognize and avoid common phishing techniques. Enforcing Multi-Factor Authentication (MFA) across all accounts provides an additional layer of protection against credential theft.
Legitimate RMM tools have been abused by threat actors to provide an easy method of accessing a compromised device. Due to the widespread use of these tools, they can easily blend into an organization’s typical usage, making it more difficult to detect malicious activity. Organizations can take proactive measures by implementing technical controls that restrict the use of certain tools on their systems or by blocking connections to known RMM-related infrastructure. Additionally, deploying Endpoint agents on all supported assets within the organization can significantly aid in the identification and containment of threats. In incidents where a user is tricked by an executable file impersonating a legitimate file, it is important for users to learn how to recognize such deceptive tactics and have the means to report them. Ongoing education is essential to keep users informed about the latest methods employed by threat actors.
In response to the release of this report, the eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities. For more insights into how threat actors are gaining initial access and exploiting legitimate RMM tools, the team has released an advisory on email bombing and ConnectWise ScreenConnect Exploitation. The Threat Response Unit (TRU) published a technical TRU Positive report on an incident involving malicious ScreenConnect use in conjunction with AsyncRAT. To support customers, eSentire MDR for Endpoint includes detections to identify and alert on misuse of RMM tooling.
Artificial Intelligence Abuse
Bottom Line: Recent reports from Microsoft and Google highlight the misuse of Artificial Intelligence (AI) by threat actors in developing novel malware and enhancing their attack methods. The reports indicate a likely increase in the use of AI by threat actors across the entire attack lifecycle in the near future.
On November 3rd, 2025, Microsoft published a report on a new backdoor malware dubbed SesameOp that leverages OpenAI Assistants Application Programming Interface (API) to support its Command-and-Control (C2) operations. The attack chain involved a loader (Dynamic Link Library file) and SesameOp, a .NET-based backdoor. The investigation into SesameOp revealed the malware component OpenAIAgent.Netapi64 that enables the backdoor’s functioning. The backdoor uses OpenAI Assistants API to retrieve commands to decrypt and execute itself on the compromised system, via a series of sophisticated checks performed by the malware. First, the backdoor fetches the hostname and queries OpenAI vector store list and adds a new list in case one does not exist. It then creates a new Assistant with a Base64-encoded hostname that can send POST requests to the host referencing its vector store ID.
On November 5th, 2025, Google Threat Intelligence Group (GTIG) published an update to their report, "Adversarial Misuse of Generative AI," released in January 2025. Google observed malware that employed AI in their development, C2 operations and other stages in attack lifecycle including reconnaissance and data exfiltration by both state-sponsored threat actors and cybercriminals. FRUITSHELL (Reverse shell) can bypass detection or analysis by Large Language Models (LLMs) while PROMPTLOCK is the first AI-powered ransomware. PROMPTFLUX (Dropper) written in VBScript that uses Google Gemini via its “Thinking Robot module” for obfuscation and evasion to enable “just-in-time” self-modification. PROMPTSTEAL (Data miner), linked to Russia’s APT28, relied on Hugging Face’s machine learning API for automated command generation, and QUIETVAULT (Information stealer) employed AI prompts and host-installed AI command-line tools to identify and exfiltrate sensitive data.
GTIG further observed state-sponsored threat actors from China, North Korea, and Iran exploiting AI systems throughout the attack lifecycle. A China-linked actor used Gemini in intrusion campaigns targeting unfamiliar cloud and containerized environments such as Amazon Web Services (AWS), vSphere, and Kubernetes. The North Korean group UNC1069 leveraged Gemini for research and to craft social engineering lures targeting cryptocurrency users, while UNC4899 and China-backed APT41 used AI models for malware development and exploit research. The Iranian group APT42 integrated Gemini into phishing operations and reportedly attempted to create a “Data Processing Agent” for tool testing and development. Additionally, multiple actors were found commercializing AI abuse, offering illicit services including deepfake generation, phishing kits, malware development, and vulnerability exploitation support. One China-linked actor notably impersonated a Capture-The-Flag (CTF) participant to bypass Gemini’s safeguards and obtain assistance with phishing, exploitation, and web shell creation.
eSentire Threat Intelligence Analysis:
The integration of AI into adversarial operations represents a fundamental, structural paradigm shift in the global cyber threat landscape. Traditionally, conducting complex and high-fidelity cyberattacks demanded significant technical expertise, time, and financial investment. Use of AI has transformed this dynamic, reducing barriers to entry and enabling threat actors to execute attacks with unprecedented speed, scale, and sophistication. By 2026, AI is expected to transition from being an exceptional tool to a normalized component of everyday attack and defense activity. A similar sentiment is echoed in a report by the United Kingdom’s National Cyber Security Centre (NCSC).
The malware families mentioned in the reports demonstrate how both state-sponsored threat actors and cybercriminals are adopting AI to enhance obfuscation, automate decision-making, and improve operational efficiency. Malware like PROMPTFLUX exhibiting “just-in-time” self-modification features highlight the abuse of AI to develop a metamorphic malware strain that renders signature-based detection obsolete. Rather than employing conventional methods, the actor behind the SesameOp backdoor exploits OpenAI’s Assistants API as a covert C2 channel to stealthily communicate and coordinate malicious activity within compromised environments. The campaign deploying SesameOp demonstrated sophisticated techniques used for payload compression, layered encryption around the executed commands, and exfiltrated data.
As new AI models continue to be released, companies developing these technologies will need to account for cybersecurity considerations and ensure responsible AI deployment. In this context, organizations must implement a multi-layered security strategy to protect against AI-enabled threats. While threat actors have begun to heavily rely on AI for supporting various operations in an attack lifecycle, it is likely that they would inadvertently reveal important details of their operations. Organizations that deploy a combination of robust Endpoint Detection and Response (EDR) tools along with comprehensive network monitoring can effectively detect and block malicious activities. Training must be updated to go beyond traditional email phishing and include simulations and education on recognizing deepfake audio, video, and generative AI scam messages.
ESET’s APT Activity Report for Q2 – Q3 2025
Bottom Line: ESET's recent APT report provides an overview of activity and motivations from recently reported attacks targeting sectors like government, energy, healthcare, and cryptocurrency, that are attributed to state-sponsored APT groups from China, Russia, Iran, and North Korea.
On November 6th, 2025, ESET published their APT Activity Report, which covers activity from select APT groups with ties to China, Iran, North Korean, and Russia, between April and September 2025. The report provides information on operations that are “representative of the broader landscape of threats”, detailing key trends and developments that were identified, including the usage of vulnerabilities and spear phishing for initial access and deployment of wiper malware for destruction.
ESET indicates that Chinese state-sponsored APT groups have remained heavily active during the outlined timeframe, with campaigns that have spanned across Asia, Europe, North America, and South America, with attacks helping to serve a wide range of China's “current geopolitical priorities”. The most targeted sectors by these threat actors include transportation, government, and engineering and manufacturing. Attacks involved the use of vulnerabilities impacting public-facing webservers to deploy webshells, and spear phishing emails containing documents to deploy payloads such as Remote Access Trojans (RATs).
Regarding Iranian-linked APT groups, ESET indicates that MuddyWater (aka Mango Sandstorm, Seedworm) has been the most active group, using phishing emails to deliver Remote Monitoring and Management (RMM) tools, malware droppers, or use access to compromised accounts to “harvest a massive amount of information that can be turned into valuable intelligence”. ESET highlights an observed campaign in June 2025 that was not attributed to a specific group, but that exhibited Tactics, Techniques, and Procedures (TTPs) with “an Iran-aligned group” that deployed wiper malware against organizations in the energy and engineering sectors in Israel.
ESET provides information on North Korean-linked APT activity, where they indicate that these groups continue to pursue the country’s geopolitical priorities, while also conducting “cybercrime-like schemes” to generate revenue for the regime. There is increasing overlap in tooling and techniques among North Korean APT groups, likely due to the “natural evolution” of the country's cyber capabilities, where operators may be “dispatched to different units to kick-start or lead other APT groups”, along with operators sharing their knowledge. ESET highlights that North Korean threat actors often target South Korea in their espionage operations, with a focus on the technology, government, and engineering and manufacturing sectors.
Russia-aligned APT groups have been observed predominately targeting Ukraine, countries with “strategic ties to Ukraine”, and Europe. Campaigns have a focus on government, defense, engineering and manufacturing, and transportation sectors, with a reliance on spear phishing and vulnerability exploitation as a means for initial access. One example provided is the group RomCom (aka Storm-0978), who utilized a zero-day vulnerability within WinRAR, tracked as CVE-2025-8088, in their phishing campaigns to deploy malware. Another campaign, conducted by the group Sandworm, was observed deploying wiper malware against a Ukrainian university, with the group having a history of deploying similar malware against various Ukrainian organizations.
eSentire Threat Intelligence Analysis:
ESET's report provides details on various campaigns conducted by APT groups that are aligned with China, Iran, North Korea, and Russia, with objectives ranging from espionage, financial, and destructive. The acronym CRINK (China, Russia, Iran, North Korea) has been used to describe the informal alliance between these nations in both cyber and kinetic warfare. These countries have also been identified as the most prominent when it comes to state-sponsored APT activity, underscoring their reliance on cyber operations to complete their objectives within an ever-evolving political landscape. While no specific overlaps in indicators and TTPs have been identified between the countries, based on ESET's report, the differing APT groups appear to target similar sectors that are commonly seen in espionage related attacks.
What is notable about ESET's observations are the usage of wiper malware within attacks conducted by both Iranian and Russian APT groups. Wiper malware is a type of malware that is used to destroy data during an infection and is often used for sabotage and within cyberwarfare. ESET states that in June 2025, wiper malware was deployed by a suspected Iranian threat actor against organizations in Israel, targeting the energy sector. The timeframe of this attack is in line with the Iran-Israel war, and may have been an attempt at causing major disruptions within the country. ESET also notes that the Russian-linked APT Sandworm was reported using wiper malware against Ukraine, amid the ongoing Russia-Ukraine war. ESET claims that the group has previously deployed wiper malware against the grain sector in Ukraine, which is considered a main export and source of revenue for Ukraine, in a likely attempt to weaken their economy. Both examples illustrate the blurred lines between cyber and physical warfare, and eSentire's Threat Intelligence team assesses with medium confidence that similar tactics will continue to be observed during ongoing and future conflicts.
The report also highlights similarities between Initial Access Vectors (IAVs) utilized by the various APT groups, with the most common being social engineering and vulnerability exploitation. Many of the groups utilize spear phishing emails as a means for deploying malicious payloads or gaining access to environments, while ESET also notes the adoption and trial of ClickFix by some groups. In April 2025, Proofpoint published a report providing details on APT groups from Iran, Russia, and North Korea adopting ClickFix into their existing social engineering campaigns, likely due to the success rate that the technique continues to have. Spear phishing and vulnerability exploitation likely provide the threat actors with a high success rate for initial access, and as new techniques are identified, these APT groups may adopt them into their toolkits as well. To protect against these threats, organizations should ensure that vulnerabilities are identified and patched within critical externally facing systems, and that Phishing and Security Awareness Training (PSAT) is conducted to educate users on how to identify and report malicious content.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
