Keys to the Kingdom: Why Attackers Are Targeting Your IT Vendors Before They Target You

Imagine you're a threat actor trying to compromise a Fortune 500 company. You could spend months probing their perimeter, burning through exploits against hardened edge infrastructure, working around a mature SOC with solid detection coverage. Or you could compromise the MSP that manages their endpoint fleet, their patch deployment, and their remote monitoring tools — and walk right in through a trusted administrative channel that their security team assumes is safe by definition.

This isn't a hypothetical. It's been the preferred playbook of nation-state actors and sophisticated ransomware groups for the better part of a decade. And the enterprises on the receiving end are often the last to know.

The Structural Problem With MSP Access

To understand why managed service providers are such attractive targets, you have to understand the access model they operate on. By design, MSPs need deep, persistent, privileged access to their clients' environments. That's the service. Remote monitoring and management (RMM) tools like ConnectWise, Kaseya, and N-able operate with agent-level access on endpoints. Professional services automation platforms sit on top of client data. Backup solutions have read/write access to production systems. Security operations services need visibility into logs and alerts.

All of that access is legitimate. All of it is necessary for the MSP to do its job. And all of it represents a massive, high-value attack surface that, if compromised, provides authenticated, trusted access to potentially hundreds of downstream client environments simultaneously.

The access-versus-security tradeoff here is almost impossible to fully resolve. You can harden an MSP's environment significantly, but you can't eliminate the fundamental reality that a single compromised MSP represents a pivot point into every organization that trusts them. That's not a configuration problem. It's an architectural reality.

Anatomy of Recent MSP Compromises

Kaseya VSA (2021) This is the case study that should have changed how every security leader thinks about vendor risk. The REvil ransomware group exploited a zero-day authentication bypass vulnerability in Kaseya's VSA on-premises product. VSA is an RMM platform used by MSPs to manage client endpoints. By compromising VSA, REvil was able to push a malicious update to managed endpoints across approximately 60 MSPs and roughly 1,500 downstream businesses. The attack happened over a holiday weekend. Many of the affected organizations didn't even know they used Kaseya — their MSP did, and that was enough.

The technical vector was a combination of an authentication bypass in the VSA web interface and a SQL injection vulnerability that allowed the attackers to upload and execute a malicious payload. The payload was delivered as a legitimate VSA software update, signed in a way that bypassed many endpoint security products. Downstream clients had no direct visibility into what was happening until systems started encrypting.

SolarWinds (2020) The SolarWinds compromise is technically a supply chain attack rather than a pure MSP attack, but it's deeply relevant here because of how it propagated through managed environments. The SUNBURST backdoor was embedded in a legitimate software update for SolarWinds Orion, a network monitoring platform widely used by MSPs and large enterprises alike. Approximately 18,000 organizations installed the compromised update. The threat actor — subsequently attributed to Russia's SVR — used that foothold to conduct targeted espionage against a subset of high-value targets, including multiple US federal agencies.

What made SolarWinds particularly devastating was the trusted relationship model. Orion had privileged access to network infrastructure across customer environments. The compromise of the update mechanism meant attackers inherited that trusted access at scale, without needing to separately compromise each target.

CTS (2023) More recently, UK-based managed services provider CTS was compromised in late 2023, affecting a significant number of law firms that relied on CTS for IT services. The breach, attributed to the Citrix Bleed vulnerability (CVE-2023-4966), disrupted conveyancing transactions across multiple legal firms during a critical period. This is a useful example because it demonstrates that MSP targeting isn't limited to nation-state actors going after defense contractors — financially motivated criminals are doing the same thing against MSPs serving professional services firms, healthcare organizations, and local governments.

What the Attack Path Actually Looks Like

MSP compromises follow a recognizable pattern once you've seen a few of them. Initial access typically comes through one of a few vectors: exploitation of internet-facing RMM infrastructure, phishing targeting MSP technicians (who have privileged access and are often targeted specifically), credential stuffing against VPN or remote access portals, or supply chain compromise of software the MSP uses.

From initial access, attackers move to establish persistence within the MSP's own environment — often targeting the RMM platform itself, since that's where the downstream client access lives. Once they have control of the RMM, lateral movement to client environments is often as simple as using the platform's legitimate remote access functionality. To the client's network, it looks like a normal connection from a trusted administrative system.

Detection is hard because the traffic patterns look legitimate. The credentials are valid. The tools are the same ones the MSP uses every day. Many organizations don't have visibility into what their MSP is doing inside their environment at any given moment — they've delegated that monitoring to the MSP itself, which creates an obvious problem when the MSP is the threat vector.

A Vendor Security Assessment Playbook

Security leaders need to stop treating MSP relationships as a trust-based handshake and start treating them as a high-risk third-party access arrangement that requires ongoing scrutiny. Here's a starting framework:

Contractual Baseline Before you sign anything, establish contractual requirements for security practices. This means: right-to-audit clauses, mandatory breach notification timelines (72 hours or less), SOC 2 Type II certification requirements, and explicit requirements around multi-factor authentication and privileged access management.

Technical Inventory Document exactly what access your MSP has. Which tools? Which accounts? Which network segments? What level of privilege? This inventory is your baseline. Any access that isn't documented shouldn't exist.

MFA and PAM Requirements Require your MSP to demonstrate that all privileged access to your environment uses phishing-resistant MFA (FIDO2/hardware keys, not SMS). Require that privileged sessions are recorded and logged. If your MSP can't demonstrate this, that's a significant risk indicator.

Network Segmentation MSP access should not be flat access to your entire network. Segment MSP connectivity. RMM traffic should traverse dedicated paths with strict firewall rules. MSP access to sensitive environments should require explicit, time-limited authorization.

Independent Monitoring Don't let your MSP be the sole monitor of their own activity in your environment. Implement independent SIEM logging that captures MSP administrative actions. You need visibility that doesn't depend on the vendor you're trying to audit.

Annual Assessments Conduct or commission annual third-party assessments of your MSP's security posture. A questionnaire is not sufficient. You want evidence — pen test reports, vulnerability scan results, access review logs.

The Uncomfortable Conversation

Here's what nobody wants to say but everyone in security knows: some MSPs, particularly smaller regional providers, have security postures that are worse than the clients they serve. They're small businesses with thin margins. Security investment is a cost center. And yet they have privileged access to hundreds of organizations.

This isn't an argument against using MSPs. For most organizations, managed services provide real value. It's an argument for treating that relationship with the same rigor you'd apply to any other high-risk third-party access arrangement — which, frankly, most organizations don't do.

The attackers have already figured out where the keys are kept. The question is whether you're going to secure the key cabinet before they come looking.