Report: Managed Service Providers Are New Frontier of Ransomware Attacks

Report: Managed Service Providers Are New Frontier of Ransomware Attacks

Hackers are targeting IT service providers as a means of attacking dozens of organizations at once and potentially reaping bigger financial rewards.

Hackers are increasingly finding ways to target several organizations at once through attacking managed service providers (MSPs) that often provide IT services to small businesses.

Several recent attacks targeted MSPs, including malware that paralyzed hundreds of dental clinics and an incident that temporarily affected services in 22 Texas cities and towns. The providers are widely used because local governments, clinics and other small organizations do not want to take on the cost of hiring their own IT staff and therefore outsource their needs to contractors.

In turn, cybercriminals can target one service provider, particularly smaller ones with fewer resources and employees, and potentially reap the financial benefits from dozens of small businesses in one attack. ProPublica recently reported on the phenomenon as ransomware attacks continue to rise and have severe consequences for organizations.

Read more: Multitude of Ransomware Attacks Cause Lawmakers to Take Notice

Hackers have largely preyed on MSPs that have weak passwords or do not use two-factor authentication. ProPublica also found that attackers have exploited issues with “remote monitoring and management” software that businesses and governments had downloaded to install systems updates.

Remote management is often used to install updates and solve users’ problems right on their screens, but can also serve as “golden keys to immediately distribute ransomware,” said Kyle Hanslovan, the CEO of cybersecurity firm Huntress Labs.

“Just like how you’d want to push a patch at lightning speed, it turns out you can push out ransomware at lightning speed as well,” he told ProPublica.

Cyber criminals have leverage over the MSPs because they often serve many companies and government agencies that contain sensitive information and need access to the data as soon as possible. The providers are more likely to pay ransoms because they are often small businesses themselves and cannot handle the influx of needs from dozens of clients that were paralyzed by the attack, according to Chris Bisnett, the chief architect at Huntress.

‘It’s one thing if I have 50 computers that are ransomed and encrypted and I can fix them,” Bisnett said. “There’s no way I have time to go and do thousands of computers all at the same time when I’ve got all these customers calling and saying: ‘Hey, we can’t do any business, we’re losing money. We need to be back right now.’ So the likelihood of the MSP just saying, ‘Oh I can’t deal with this, let me just pay,’ goes up.”

The rapid growth of ransomware attacks does not seem to be slowing down any time soon, particularly as the insurance industry continues to incentivize hackers by paying the ransoms instead of doling out money for data recovery services.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Paving the Way to Smart Buildings

    In today's rapidly evolving security landscape, the convergence of on-prem, edge and cloud technologies are critical. The physical security landscape is undergoing a profound transformation, driven by the rapid digitalization of buildings and the evolving needs of modern organizations. As the buildings sector pivots towards smart, AI and data-driven operations, the integration of both edge and cloud technology has become crucial. Read Now

  • The Cybersecurity Time Bomb

    If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk. Read Now

  • Deploying in a Hybrid, Cloud Environment

    The way organizations manage access control is evolving. Traditional on-premises systems come with high IT and server requirements. At the same time, fully cloud-based solutions may not meet the needs of every facility. Read Now

  • Facing Facts for Facilities

    Despite the proliferation of constantly evolving security solutions, there remains a troubling trend among many facility operators who often neglect the most important security assets within their organization. Keys and shared devices like radios, laptops and tablets are crucial to successful operations, yet many operators are managing them haphazardly through outdated storage systems like pegboards and notebooks. Read Now

  • Report Reveals Security Training Reduces Global Phishing Click Rates by 86%

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, today launched its “Phishing by Industry Benchmarking Report 2025” which measures an organization’s Phish-prone Percentage (PPP) — the percentage of employees likely to fall for social engineering or phishing attacks, indicating the organization’s overall susceptibility to phishing threats. This year’s report found a global average baseline PPP of 33.1%, meaning a third of employees interact with phishing simulations before taking part in best-practice security awareness training (SAT).COVER 2025-PIB-NA-Report_EN-US Read Now

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities