{"id":27402,"date":"2019-06-20T23:49:49","date_gmt":"2019-06-20T23:49:49","guid":{"rendered":"http:\/\/350d5838-7274-4c90-bb44-9c6dc7b04423"},"modified":"2019-06-20T23:49:49","modified_gmt":"2019-06-20T23:49:49","slug":"ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/","title":{"rendered":"Ransomware gang hacks MSPs to deploy ransomware on customer systems"},"content":{"rendered":"<p>A ransomware gang has breached the infrastructure of at least three managed service providers (MSPs) and has used the remote management tools at their dispossal, namely the Webroot SecureAnywhere console, to deploy ransomware on the MSPs&#8217; customers systems.<\/p>\n<p>The ransomware infections were <a href=\"https:\/\/old.reddit.com\/r\/msp\/comments\/c2wls0\/kaseya_weaponized_to_deliver_sodinokibi_ransomware\/\" target=\"_blank\" rel=\"noopener noreferrer\">first reported today in a Reddit section dedicated to MSPs<\/a> &#8212; companies that provide remote IT services and support to companies across the world.<\/p>\n<p>Kyle Hanslovan, co-founder and CEO of Huntress Lab, was online and helped some of the impacted MSPs investigate the incidents.<\/p>\n<h3>Hackers got in via RDP<\/h3>\n<p>Hanslovan said hackers breached MSPs via exposed RDP (Remote Desktop Endpoints), elevated privileges inside compromised systems, and manually uninstalled AV products, such as ESET and Webroot.<\/p>\n<p>In the next stage of the attack, the hackers searched for accounts for <a href=\"https:\/\/my.webrootanywhere.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Webroot SecureAnywhere<\/a>, remote management software (console) used by MSPs to manage remotely-located workstations (in the network of their customers).<\/p>\n<p>According to Hanslovan, the hackers used the console to execute <a href=\"https:\/\/gist.github.com\/KyleHanslovan\/e261e5f357c4796d9f1d4ee2b0112218\" target=\"_blank\" rel=\"noopener noreferrer\">a Powershell script<\/a> on remote workstations; script that downloaded and installed the Sodinokibi ransomware.<\/p>\n<p>The Huntress Lab CEO said at least three MSPs had been hacked this way. Some Reddit users also reported that in some cases, hackers might have also used the Kaseya VSA remote management console, but this was never formally confirmed.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_ZD_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>&#8220;Two companies mentioned only the hosts running Webroot were infected,&#8221; Hanslovan said. &#8220;Considering Webroot&#8217;s management console allows administrators to remotely download and execute files to endpoints, this seems like a plausible attack vector.&#8221;<\/p>\n<h3>Webroot deploys 2FA for SecureAnywhere accounts<\/h3>\n<p>Later in the day, Webroot began forcibly enabling two-factor authentication (2FA) for SecureAnywhere accounts, according to an email Hanslovan received, hoping to prevent hackers from using any other potentially hijacked accounts to deploy new ransomware throughout the day.<\/p>\n<p>SecureAnywhere supports 2FA, but the feature is not enabled by default.<\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet4.cbsistatic.com\/hub\/i\/r\/2019\/06\/20\/17f35c1c-2896-47c6-abef-e600b4172ea3\/resize\/370xauto\/8655b73c45c3757e1bbf984e4128f687\/webroot-email.jpg\" class alt=\"Webroot email for enabling 2FA\" height=\"auto\" width=\"370\"><\/span> <span class=\"credit\">Image: Kyle Hanslovan<\/span><\/p>\n<p><a href=\"https:\/\/blog.talosintelligence.com\/2019\/04\/sodinokibi-ransomware-exploits-weblogic.html\" target=\"_blank\" rel=\"noopener noreferrer\">The Sodinokibi ransomware<\/a> is a relatively new ransomware strain, discovered in late April. At the time, a threat actor was using an Oracle WebLogic zero-day to <a href=\"https:\/\/www.zdnet.com\/article\/recent-oracle-weblogic-zero-day-used-to-infect-servers-with-ransomware\/\" target=\"_blank\" rel=\"noopener noreferrer\">hack into company networks and deploy the ransomware<\/a>.<\/p>\n<p>Today&#8217;s incident is also the second major wave of attacks during which hackers abused MSPs and their remote management tools to deploy ransomware on their customers&#8217; networks.<\/p>\n<p>The first incident happened in mid-February when a hacker group used vulnerabilities in commonly-used MSP tools <a href=\"https:\/\/www.zdnet.com\/article\/gandcrab-ransomware-gang-infects-customers-of-remote-it-support-firms\/\" target=\"_blank\" rel=\"noopener noreferrer\">to deploy the GandCrab ransomware on customers&#8217; workstations<\/a>.<\/p>\n<p>Coincidentally, at the time this incident was being detailed on Reddit, local media in Romania was reporting that <a href=\"https:\/\/www.hotnews.ro\/stiri-sanatate-23213537-sorina-pintea-atacuri-informatice-5-spitale-din-bucuresti-ingreuneaza-foarte-mult-activitatea-medicala-fiecare-spital-are-obligatia-isi-protejeze-datele.htm\" target=\"_blank\" rel=\"noopener noreferrer\">five hospitals had been infected with ransomware<\/a> in Bucharest, the country&#8217;s capital. However, there is no evidence that the two events are linked, outside the infection timeframe.<\/p>\n<h3>Related malware and cybercrime coverage:<\/h3>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers breach MSPs and use Webroot SecureAnywhere console to infect customer PCs with the Sodinokibi ransomware.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":27403,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-27402","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ransomware gang hacks MSPs to deploy ransomware on customer systems 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware gang hacks MSPs to deploy ransomware on customer systems 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-06-20T23:49:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/06\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"370\" \/>\n\t<meta property=\"og:image:height\" content=\"231\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware gang hacks MSPs to deploy ransomware on customer systems\",\"datePublished\":\"2019-06-20T23:49:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/\"},\"wordCount\":455,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/\",\"name\":\"Ransomware gang hacks MSPs to deploy ransomware on customer systems 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg\",\"datePublished\":\"2019-06-20T23:49:49+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/06\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg\",\"width\":370,\"height\":231},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware gang hacks MSPs to deploy ransomware on customer systems\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware gang hacks MSPs to deploy ransomware on customer systems 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware gang hacks MSPs to deploy ransomware on customer systems 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-06-20T23:49:49+00:00","og_image":[{"width":370,"height":231,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/06\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware gang hacks MSPs to deploy ransomware on customer systems","datePublished":"2019-06-20T23:49:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/"},"wordCount":455,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/06\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/","name":"Ransomware gang hacks MSPs to deploy ransomware on customer systems 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/06\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg","datePublished":"2019-06-20T23:49:49+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/06\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/06\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems.jpg","width":370,"height":231},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ransomware gang hacks MSPs to deploy ransomware on customer systems"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/27402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=27402"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/27402\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/27403"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=27402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=27402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=27402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}