More threat actors have started targeting MSPs over the years. There are many reasons why MSPs are valuable targets for attackers, including their customer bases and the data that they handle. Here are some of the biggest reasons why MSPs are on threat actors’ radars.

Valuable access

MSPs often need privileged access to manage customer systems, support critical processes, or store data. This level of access makes them an attractive target for threat actors. An MSP data breach can grant attackers entry to customer systems or access to sensitive information.

Multiple customers

MSPs have multiple customers, and for threat actors, that means a bigger bang for their (cyberattack) buck. One attack on an MSP can give threat actors the ability to use their compromise as a foothold to launch supply chain attacks against several small and medium-sized downstream customers. 

Trusted relationships with customers

Threat actors can target MSPs in the same ways that they do most other businesses: through phishing attacks, compromising credentials on accounts without multi-factor authentication (MFA), exploiting unpatched security flaws, and targeting publicly exposed Remote Desktop Protocol (RDP) instances. 

Once threat actors have gained initial access to an MSP environment, they can steal sensitive data from the MSP, but also use several techniques to target their customers. For example, MSPs typically use remote monitoring and management (RMM) tools like ScreenConnect or TeamViewer as a way to offer hands-on support to customers. This can give threat actors a leg up in their attacks. They can abuse existing MSP RMM instances in order to stealthily conduct a supply chain attack against customers, stealing data, deploying ransomware, and more. 

Multiple threat actors have targeted MSPs, including state-sponsored APT groups. 

In 2021, a Russian nation-state group reportedly targeted resellers and technology service providers across the U.S. and Europe. These attacks allowed threat actors to target victims’ delegated administrative privileges, like adding users or resetting passwords, in their attacks.

Also in 2021, the REvil ransomware group launched a sophisticated supply chain attack against Kaseya’s VSA product in order to impact MSPs and their customers. Threat actors used an arbitrary file upload and code injection vulnerability to carry out the attack, which led to the compromise of over 1,000 businesses.

Huntress sees a fair number of incidents where threat actors are targeting MSPs. In June 2025, Huntress’ Security Operations Center (SOC) analysts saw an incident where a threat actor compromised an MSP’s RMM instance, effectively using that instance to target three of its customers before the Huntress SOC was able to isolate the impacted endpoint and work with the partner to remediate the attack.

MSPs can protect themselves from attacks in a variety of ways. Here are some ways to proactively prevent initial compromise:

• Enforce MFA on MSP accounts, particularly ones that access customers’ environments.

• Identify and disable accounts that are no longer in use. MSP customers should also disable MSP accounts that are no longer managing infrastructure.

• Defend against phishing attacks with expert-backed managed security awareness training.

Improving MSP security

Here are some other measures that MSPs can take to help improve their security:

• CISA recommends that organizations store their most important logs for at least six months, with MSPs logging both internal and customer network activity as specified in their customer contracts. MSPs can implement a logging process to detect threats through the use of a security information and event management (SIEM) solution or logging tools 

• MSPs should segregate their networks to reduce the impact of an intrusion. In particular, segregate customer data sets from each other and from internal company networks. 

• MSPs and their customers should proactively and transparently identify who is in charge of which security roles and responsibilities as part of their contracts.

MSPs remain a high-value target for cybercriminals because of the trust and extensive access they hold with their customers, coupled with the critical data they manage. To combat this risk, MSPs must proactively address any security weaknesses and ensure that roles and responsibilities between themselves and their clients are clearly defined in contractual agreements.