Access to customer environments

MSP technicians often need administrative access to configure systems, troubleshoot problems, and support customer operations. If an attacker steals or misuses one of those accounts, they may inherit access that's broader than a typical employee's.

A path to multiple organizations

MSPs support many customers, often from a shared set of management tools and processes. A compromise of an MSP's environment or a trusted tool can therefore create risk for more than one organization. That doesn't mean every MSP incident becomes a supply-chain attack, but it does make access controls and separation between customer environments especially important.

Trusted relationships

Attackers can exploit the trust between MSPs and their customers through social engineering. For example, a threat actor may impersonate a help-desk worker, pressure someone to reset an account, or persuade a user to approve a sign-in or run a remote-access tool. Treat unexpected requests involving credentials, authentication codes, or remote access as high risk—even when they appear to come from a familiar contact.

Threat actors can target MSPs in the same ways that they do most other businesses: through phishing attacks, compromising credentials on accounts without multi-factor authentication (MFA) enabled, exploiting unpatched security flaws, and targeting publicly exposed Remote Desktop Protocol (RDP) instances. 

Once threat actors have gained initial access to an MSP environment, they can steal sensitive data from the MSP, but also use several techniques to target their customers. For example, MSPs typically use RMM tools like ScreenConnect or TeamViewer as a way to offer hands-on support to customers. This can give threat actors a leg up in their attacks. They can abuse existing MSP RMM instances in order to stealthily conduct a supply chain attack against customers, stealing data, deploying ransomware, and more.

MSPs can be targeted by financially motivated cybercriminals as well as more capable groups seeking access to downstream organizations. The 2021 Kaseya VSA ransomware attack attributed to the REvil threat group remains a useful historical example.

Huntress sees a fair number of incidents where threat actors are targeting MSPs. In June 2025, Huntress' Security Operations Center (SOC) analysts responded to an incident where a threat actor compromised an MSP's RMM instance, effectively using that instance to target three of its customers before the Huntress SOC was able to isolate the impacted endpoint and work with the partner to remediate the attack.

No single control prevents every compromise. MSPs can reduce the likelihood and impact of an attack by protecting privileged access, limiting paths between customers, and preparing to detect and contain suspicious activity.

Protect identities and privileged access

• Require MFA for remote access, email, cloud administration, RMM tools, and other accounts that can reach customer environments.

• Use phishing-resistant MFA for privileged users where supported.

• Give each technician a separate account and only the permissions needed for their role; avoid shared administrator accounts.

• Review accounts and access regularly, and promptly disable accounts that are no longer needed—including customer accounts used by former providers or staff.

• Use a controlled process for password resets, authentication changes, and requests to approve sign-ins.

Secure endpoints, software, and remote access

• Maintain an inventory of MSP-managed assets and internet-facing services.

• Patch operating systems, applications, and network devices according to risk and vendor guidance.

• Disable exposed remote access that isn't required, and restrict allowed access to approved users and devices.

• Limit RMM access, review its activity, and use separate permissions or accounts where practical to reduce the reach of a compromised credential.

Separate customer environments

• Avoid using one broadly privileged account to administer every customer environment.

• Separate customer data and administrative access from the MSP's internal network wherever practical.

• Use network segmentation and customer-specific access controls to limit how far an attacker can move if one account or system is compromised.

Improve detection and response

• Collect and review relevant identity, endpoint, remote-access, and RMM logs. Make sure someone is responsible for investigating suspicious activity.

• Define how the MSP and each customer will report, investigate, and respond to security incidents. Document who owns each action and how to reach them outside normal channels.

• Prepare and test response steps for compromised administrator accounts, unauthorized RMM activity, and suspected customer-environment access.

• Maintain backups and validate that recovery procedures work; protect backup access so an attacker who compromises production systems can't easily change or delete recovery copies.

Train staff to spot social engineering

Use practical, ongoing security awareness training to help employees recognize phishing, help-desk impersonation, and unusual requests for credentials or remote access. Make reporting suspicious activity straightforward, and reinforce that staff should verify sensitive requests through a separate channel.

MSPs are high-value targets because one compromise can affect multiple downstream customer environments. Use the Neighborhood Watch Program to protect your own MSP with free internal-use Huntress licenses and strengthen the defenses attackers are most likely to test.

Neighborhood Watch Program

MSPs are attractive targets because their people, accounts, and tools can provide access to customer environments. Protecting that trust starts with strong authentication and least-privilege access, but it also takes customer separation, timely patching, useful monitoring, and a practiced response plan.

Review privileged access regularly, agree with customers on who owns each security responsibility, and make sure your team knows what to do when an account or management tool may be compromised.

Don't leave your business vulnerable. Partner with Huntress for real-time EDR support to detect and disrupt threats before they wreak havoc. Take action now and strengthen your defenses.