Targeting a single managed service provider to reach dozens of businesses simultaneously is one of the most effective force multipliers available to ransomware operators. The economics are straightforward: one MSP breach, one credential set, one RMM tool with administrative access to hundreds of client endpoints. The cost of the intrusion is amortised across every victim the MSP serves.
The technique has been documented in high-profile incidents since at least 2019, but the volume of MSP-targeting activity has increased as RaaS affiliates look for routes around improving endpoint detection. When an MSP pushes a ransomware payload through its own RMM infrastructure using its own trusted certificate, endpoint defences that rely on origin and signature often fail to detect it.
How MSP-Targeting Campaigns Work
The attack chain follows a consistent pattern across documented incidents:
Phase 1: MSP initial access. The most common entry points are internet-exposed RMM portals, VPN credentials obtained through credential stuffing or purchased from initial access brokers, and exploitation of vulnerabilities in MSP management tools. Exposed ConnectWise ScreenConnect instances (before authentication was enforced by default), Kaseya VSA, and N-able N-central have all featured in documented campaigns.
Phase 2: Lateral movement within MSP infrastructure. Once inside the MSP environment, attackers establish persistence and enumerate client connections. The RMM tool itself is the target — it contains agent endpoints, API keys, and management consoles that provide command execution on client machines. In some cases, attackers have used MSP credential stores (Active Directory, password managers shared across the MSP team) to harvest client portal credentials directly.
Phase 3: Cascade deployment across clients. Using the RMM tool’s legitimate management capabilities, attackers deploy ransomware payloads across client endpoints. The deployment appears to originate from the MSP’s trusted management infrastructure, which means it often passes allowlisting and other endpoint controls that look for untrusted executables.
Phase 4: Simultaneous encryption. In well-executed campaigns, the ransomware triggers across multiple client environments within a short window — sometimes simultaneously — limiting the victim’s ability to detect and stop the spread before widespread encryption occurs.
Notable Documented Campaigns
Kaseya VSA (July 2021) — The landmark MSP cascade attack. REvil (Sodinokibi) exploited a zero-day in Kaseya’s VSA on-premises product, bypassing authentication and deploying ransomware to approximately 1,500 businesses across 17 countries via their MSPs. The scale was unprecedented: a single vulnerability weaponised against MSPs with Kaseya on-premises deployments simultaneously, without requiring individual compromise of each MSP.
ConnectWise ScreenConnect (2024) — CVE-2024-1709, a critical authentication bypass, was exploited by multiple threat actors within days of disclosure. MSPs running unpatched on-premises instances were compromised and their client access leveraged for ransomware deployment. LockBit affiliates, among others, incorporated the exploit into their toolkit.
MSP targeting by Akira (2025-2026) — Akira has demonstrated a preference for MSPs and IT service firms as initial access points, recognising the downstream value. The group’s focus on SonicWall SSL VPN vulnerabilities and Cisco ASA credentials has yielded a number of MSP compromises where client environments were subsequently encrypted.
Black Basta MSP targeting — Black Basta’s operational tradecraft, as exposed in leaked internal communications, included explicit discussion of targeting MSPs and other organisations with privileged access to multiple downstream clients as a way to maximise the efficiency of affiliate campaigns.
The Force Multiplier Calculation
The incentive for ransomware operators is simple arithmetic. A direct attack against a single business requires reconnaissance, initial access, and lateral movement specific to that target. An MSP compromise can yield the same access against 50-300 businesses using the same infrastructure and credentials, with lateral movement already completed by the MSP’s own management tooling.
For RaaS operations with affiliate models, this translates to ransom demands across multiple simultaneous victims, each with separate negotiations. Even if individual ransom amounts are lower (smaller businesses, less ability to pay), the aggregate return on investment is significantly higher than a single-target engagement.
The asymmetry also favours the attacker at the detection layer. MSP management traffic — RMM agent communications, remote script execution, automated patch deployment — is trusted by design. Defenders at the client level often have no visibility into the MSP’s management plane and no baseline for what legitimate MSP activity looks like versus malicious MSP activity.
Sector Exposure
MSP-dependent businesses include a disproportionate share of small and mid-sized organisations in sectors with high data sensitivity:
- Healthcare — GP practices, dental offices, and specialist clinics rely on MSPs for clinical system management. Patient data encryption is both operationally devastating and regulatory-reportable.
- Legal and professional services — law firms, accountants, and consulting firms with confidential client data but limited in-house IT capability.
- Manufacturing SMBs — factories and suppliers using MSPs for IT while running OT environments that may be indirectly reachable through IT network segments.
- Financial services — independent financial advisers, insurance brokers, and credit unions that rely on MSPs for regulated system management.
These sectors are common ransomware targets in their own right. The MSP route adds a structural amplifier to existing sector-targeting strategies.
Detection and Response Considerations
At the MSP level:
- RMM tool authentication logs should be monitored for credential use outside normal operating hours, from unusual geographies, or with MFA bypass.
- API key creation or export within RMM platforms is a high-signal indicator of adversary activity — legitimate operations rarely require new API key generation outside provisioning windows.
- Script execution through RMM tooling at scale (pushing a script to hundreds of endpoints simultaneously) should trigger an alert unless it matches a scheduled maintenance window.
- Lateral movement within MSP internal AD (credential spraying, Kerberoasting attempts, DCSync) follows standard AD attack patterns and is detectable with Sigma rules regardless of downstream intent.
At the client level:
- Treat MSP-originated remote sessions as untrusted until verified. Log RMM agent activity centrally — who connected, when, from what IP, and what they executed.
- Any new executable arriving via RMM agent should be hashed and checked against threat intelligence before execution.
- Network segmentation: MSP management traffic should originate from known IP ranges. Out-of-band verification for unusual MSP activity is a reasonable compensating control for high-value environments.
Contractual and vendor risk controls:
- Require evidence of MFA enforcement on all MSP management systems as a contract condition.
- Include MSP incident notification requirements in service agreements — the UK Cyber Security and Resilience Bill is formalising this for regulated sectors, but MSP contracts should not wait for regulation.
- Audit vendor access reviews: what can your MSP access, and is that access still scoped to what you actually need?
The MFA Gap
A recurring finding across MSP compromises is that RMM portals and VPN concentrators were accessible with username and password alone. MFA on internet-facing management infrastructure is the single most effective preventive control for MSP initial access and it remains inconsistently deployed. Require it. Verify it. Do not accept an MSP’s word that it is enabled without an audit artefact.
The MSP attack surface is a structural feature of how small and mid-market IT services are delivered. It will not disappear, and the incentives for ransomware operators to target it will not diminish. The defensive response is a combination of technical controls at both the MSP and client layers, contractual requirements that impose security obligations on MSPs, and client-side visibility into MSP activity that does not currently exist in most environments.