MSP Supply Chain Attacks: When Your IT Provider Becomes the Attack Vector

MSP supply chain attacks don't target your company. They target the firm you hired to protect it. Managed service providers sit at the center of hundreds or thousands of client networks simultaneously, managing endpoints, deploying software, and holding administrative credentials across every environment they touch. That centralized access, designed for operational efficiency, creates a single point of compromise that threat actors have systematically exploited for over a decade.

This article covers the documented pattern of MSP-targeted attacks — the Kaseya VSA breach, the SolarWinds supply chain compromise, and the broader MSP hacking ecosystem — and what it means for the mid-market companies and PE portfolio operators who depend on managed services for their security operations.

What Happened

The MSP supply chain attack pattern has two landmark incidents that define the threat model:

Kaseya VSA — July 2021

On July 2, 2021, the REvil ransomware group exploited zero-day vulnerabilities (CVE-2021-30116) in Kaseya's VSA remote monitoring and management software. The attack targeted on-premises VSA servers operated by MSPs, using the VSA platform's own software deployment capability to push a malicious update to managed endpoints. The attack was timed to coincide with the US Independence Day weekend — a period of reduced security staffing at both MSPs and their clients.

Approximately 60 MSPs were directly compromised. Through those MSPs, roughly 1,500 downstream businesses were affected. REvil initially demanded ransoms from individual businesses (ranging from $45,000 to $5 million per victim), then issued a blanket demand of $70 million for a universal decryption key covering all victims. Kaseya obtained a decryption key approximately three weeks after the attack — through means later reported to involve law enforcement — and provided it to affected organizations.

SolarWinds Orion — December 2020

Russian SVR actors (Cozy Bear / APT29) compromised the SolarWinds Orion software build pipeline between March and June 2020. The SUNBURST backdoor was distributed to approximately 18,000 customers as part of legitimate software updates. Affected organizations included US federal agencies (Treasury, Commerce, Homeland Security), major technology companies, and MSPs that used SolarWinds Orion for network monitoring.

MSPs in the blast radius unknowingly distributed the backdoor to their own managed clients, extending the reach of the original compromise through the MSP's trusted update and deployment channels. The attack remained undetected for approximately nine months before FireEye disclosed it in December 2020.

Ongoing Pattern

Beyond these landmark incidents, CISA and FBI joint advisories issued in 2022 and 2023 specifically identified MSPs as high-priority targets for ransomware affiliates and state-sponsored actors. ConnectWise ScreenConnect vulnerabilities (2024), N-able N-central credential theft campaigns, and ongoing spearphishing targeting MSP helpdesk staff represent the continuous baseline of MSP-targeted activity separate from the high-profile incidents.

How MSP Attacks Work

MSP-targeted attacks exploit the trust and access that MSPs hold across client environments. The attack vectors fall into three documented patterns:

RMM platform compromise. Remote monitoring and management (RMM) tools are the operational backbone of MSP service delivery — they provide persistent, privileged remote access to every managed endpoint. Compromising the RMM platform gives an attacker administrative control over every client endpoint simultaneously. The 2021 Kaseya VSA attack exploited a zero-day vulnerability in the Kaseya VSA RMM platform to deploy REvil ransomware to approximately 1,500 businesses across 37 MSPs in a single operation.

Software supply chain compromise. The 2020 SolarWinds Orion attack — in which Russian SVR actors compromised the SolarWinds software build pipeline and distributed a backdoored update to approximately 18,000 customers — represents the supply chain variant. MSPs that used SolarWinds Orion for network monitoring unknowingly distributed the backdoor (SUNBURST) to their own managed clients. The attacker accessed the MSP's distribution infrastructure, not the client networks directly.

Credential theft and direct MSP compromise. MSP employee credentials — particularly those with administrative access to client environments — are high-value targets for credential theft, phishing, and MFA bypass campaigns. Scattered Spider campaigns have specifically targeted MSP helpdesk staff using social engineering to obtain credentials that provide access to client environments. CISA and FBI joint advisories have repeatedly warned that MSP administrative credentials are actively sought by ransomware affiliates.

Why MSPs Are Strategic Targets

The economics of MSP targeting are straightforward. A single successful MSP compromise gives an attacker access to hundreds of client environments simultaneously, with the same operational effort required to compromise a single target. This multiplier effect makes MSPs disproportionately valuable targets relative to the effort required to attack them.

The adversary calculus: a ransomware group that compromises an MSP managing 200 mid-market clients can deploy ransomware across all 200 simultaneously, dramatically increasing ransom collection probability. The Kaseya attack reportedly demanded $70 million in aggregate ransom — a figure achievable only because the blast radius covered hundreds of separate organizations.

PE Implications

For PE firms conducting cyber due diligence on mid-market acquisitions, MSP dependency is a risk factor that current standard DD frameworks frequently miss.

MSP concentration risk. Portfolio companies that rely on a single MSP for all IT management — network, endpoints, security operations, and cloud — have concentrated their cyber risk into a single third party. If that MSP is compromised, the portco's ability to respond is limited by the same degraded infrastructure the attacker is using. Diversification of MSP relationships — or at minimum, independent security monitoring capability that does not rely on the MSP's own tooling — reduces single-point-of-failure risk.

Cross-portfolio MSP exposure. PE firms that recommend or broker MSP relationships across their portfolio create a second-order supply chain risk: if the recommended MSP is compromised, the breach may affect multiple portfolio companies simultaneously. This aggregated exposure is material from a fund-level risk perspective and is rarely quantified in portfolio risk assessments.

Deal timeline risk. An undisclosed MSP supply chain breach that occurred before close but was discovered post-close creates reps and warranties exposure for the seller and potential material adverse change considerations for the buyer. Standard cyber reps in acquisition agreements typically require disclosure of known security incidents — an MSP breach that the target company was not directly notified of creates ambiguity about what the seller "knew" and when.