Sunday, June 15, 2025
HomeCyber Security NewsFBI, CISA, and NSA Warns of Cyberattacks Targeting MSPs

FBI, CISA, and NSA Warns of Cyberattacks Targeting MSPs

Published on

SIEM as a Service

Follow Us on Google News

The latest reports observe a rise in malicious cyber activity targeting managed service providers (MSPs) and anticipate this trend to continue.

The Cybersecurity and Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory along with Federal law enforcement partners and international allies that warn of an increase in malicious cyber activity targeting MSPs.

“The UK, Australian, Canadian, New Zealand, and U.S. cybersecurity authorities expect malicious cyber actors—including state-sponsored advanced persistent threat (APT) groups—to step up their targeting of MSPs in their efforts to exploit provider-customer network trust relationships,” the joint advisory reads.

- Advertisement - Google News

Managed Service Providers

MSPs are entities that deliver, operate, or manage ICT services and functions for their customers via a contractual arrangement, such as a service level agreement.

It offers services in conjunction with other providers that include platform, software, and IT infrastructure services; business process and support functions; and cybersecurity services. MSPs manage these services and functions in their customer’s network environment, either on the customer’s premises or hosted in the MSP’s data center.

MSPs can also offer cloud services, CISA noted this joint advisory “does not address guidance on cloud service providers (CSPs).”

Actions MSPs Can Take to Strengthen their Cyber Defences

  • Improve the security of vulnerable devices by selecting and Hardening Remote Access VPN Solutions, and Vulnerability Scanning Tools and Services
  • Securing internet-facing services
  • Defend against brute force and password spraying
  • Defend against phishing

Detection and Network Defense Monitoring Capabilities

  • MSPs should log the delivery infrastructure activities used to provide services to the customer
  • Implement complete security event management that enables appropriate monitoring and logging of provider-managed customer systems;

The advisory also recommends MSPs secure remote access applications and enforce multi-factor authentication, develop and exercise incident response and recovery plans, and understand and proactively manage supply chain risk.

According to CISA Director Jen Easterly, “We know that MSPs that are vulnerable to exploitation significantly increase downstream risks to the businesses and organizations they support.”Securing MSPs is critical to our collective cyber defense, and CISA and our interagency and international partners are committed to hardening their security and improving the resilience of our global supply chain.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...