Report: Managed Service Providers Are New Frontier of Ransomware Attacks

Report: Managed Service Providers Are New Frontier of Ransomware Attacks

Hackers are targeting IT service providers as a means of attacking dozens of organizations at once and potentially reaping bigger financial rewards.

Hackers are increasingly finding ways to target several organizations at once through attacking managed service providers (MSPs) that often provide IT services to small businesses.

Several recent attacks targeted MSPs, including malware that paralyzed hundreds of dental clinics and an incident that temporarily affected services in 22 Texas cities and towns. The providers are widely used because local governments, clinics and other small organizations do not want to take on the cost of hiring their own IT staff and therefore outsource their needs to contractors.

In turn, cybercriminals can target one service provider, particularly smaller ones with fewer resources and employees, and potentially reap the financial benefits from dozens of small businesses in one attack. ProPublica recently reported on the phenomenon as ransomware attacks continue to rise and have severe consequences for organizations.

Read more: Multitude of Ransomware Attacks Cause Lawmakers to Take Notice

Hackers have largely preyed on MSPs that have weak passwords or do not use two-factor authentication. ProPublica also found that attackers have exploited issues with “remote monitoring and management” software that businesses and governments had downloaded to install systems updates.

Remote management is often used to install updates and solve users’ problems right on their screens, but can also serve as “golden keys to immediately distribute ransomware,” said Kyle Hanslovan, the CEO of cybersecurity firm Huntress Labs.

“Just like how you’d want to push a patch at lightning speed, it turns out you can push out ransomware at lightning speed as well,” he told ProPublica.

Cyber criminals have leverage over the MSPs because they often serve many companies and government agencies that contain sensitive information and need access to the data as soon as possible. The providers are more likely to pay ransoms because they are often small businesses themselves and cannot handle the influx of needs from dozens of clients that were paralyzed by the attack, according to Chris Bisnett, the chief architect at Huntress.

‘It’s one thing if I have 50 computers that are ransomed and encrypted and I can fix them,” Bisnett said. “There’s no way I have time to go and do thousands of computers all at the same time when I’ve got all these customers calling and saying: ‘Hey, we can’t do any business, we’re losing money. We need to be back right now.’ So the likelihood of the MSP just saying, ‘Oh I can’t deal with this, let me just pay,’ goes up.”

The rapid growth of ransomware attacks does not seem to be slowing down any time soon, particularly as the insurance industry continues to incentivize hackers by paying the ransoms instead of doling out money for data recovery services.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Busy South Africa Building Integrates Custom Access Control System

    Nicol Corner, based in Bedfordview, Johannesburg, South Africa, is home to a six-star fitness club, prime office space, and an award-winning rooftop restaurant. This is the first building in South Africa to have its glass façade fully incorporate fritted glazing, saving 35% on energy consumption. Nicol Corner (Pty) LTD has developed a landmark with sophisticated design and unique architecture by collaborating with industry-leading partners and specifying world-class equipment throughout the project. This includes installing a high-spec, bespoke security and access control system. Read Now

  • Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

Featured Cybersecurity

Webinars

New Products

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3