Guardz Report: AI-Driven Attacks Amplify Threats for MSPs and SMBs
AI-Driven Attacks Fueling MSP Supply Chain Risk, Guardz Report Finds
Related Entities
Products & Tech
Other
Full Report
Executive Summary
Cybersecurity firm Guardz has released its 2026 State of MSP Threat Report, revealing that threat actors are leveraging Artificial Intelligence to dramatically increase the speed and scale of attacks against Managed Service Providers (MSPs) and their Small and Medium-sized Business (SMB) customers. The report finds that an alarming nine out of ten SMBs have compromised users. Key findings include a significant increase in financial losses from Business Email Compromise (BEC) and the widespread abuse of legitimate Remote Monitoring and Management (RMM) tools like ScreenConnect, which has become the primary vector for supply chain attacks targeting MSPs.
Threat Overview
The report paints a picture of an evolving threat landscape where AI allows attackers to operate at a pace that outstrips human-led security teams. The financial impact is stark: confirmed losses from BEC incidents now range from $140,000 to $1.5 million, a huge jump from the $40,000 average in early 2025.
A critical and growing threat is the abuse of RMM tools. These legitimate tools, used by MSPs to manage client systems, are being turned into weapons by attackers. The report found that RMM tool abuse was the single largest endpoint threat campaign, accounting for 26% of all detections. Attackers were observed using tools such as ScreenConnect, AteraAgent, and MeshAgent to gain unauthorized, persistent access to client networks. This represents a severe supply chain attack vector, as compromising a single MSP's RMM tool can grant an attacker a foothold in the networks of hundreds or thousands of downstream clients.
Technical Analysis
Attackers are leveraging AI and legitimate tools to bypass traditional defenses and achieve their objectives.
- AI-Powered Phishing and BEC: AI is used to craft highly convincing, personalized phishing emails at scale, leading to credential theft and BEC. The dramatic increase in financial loss suggests these campaigns are becoming more effective and targeted.
- Living Off the Land (LotL): By abusing legitimate RMM tools, attackers can evade detection. Security products are less likely to flag activity from a trusted tool like ScreenConnect. This is a classic LotL technique (
T1219- Remote Access Software). - Supply Chain Compromise: The primary attack chain involves compromising an MSP, either through phishing or exploiting a vulnerability. Once the MSP is breached, attackers gain access to their RMM platform (
T1078- Valid Accounts). From there, they can push malicious scripts or gain interactive access to any client managed by that MSP (T1021.004- Remote Services: SSH). - Shift in Attacker Behavior: The report notes a trend where attackers, once inside an account, are focusing more on deepening their access and understanding the environment rather than just immediate financial gain. This indicates a move towards more patient, long-term compromises.
Impact Assessment
The impact on MSPs and SMBs is profound. For SMBs, a breach can be an existential threat. For MSPs, a supply chain compromise can destroy their reputation and business. The widespread nature of the problem (9 in 10 SMBs with compromised users) indicates a systemic weakness in the ecosystem. Guardz's threat hunting team predicts that these MSP-focused supply chain attacks will intensify in the second half of 2026. The report also highlights the necessity of AI in defense, noting that AI-driven detection achieved a 92.4% accuracy rate, far surpassing the 67% for human analysts alone.
IOCs — Directly from Articles
No specific Indicators of Compromise were provided in the source articles.
Cyber Observables — Hunting Hints
MSPs and their clients should hunt for signs of RMM tool abuse:
ScreenConnect.ClientService.exe) should not be spawning processes like mimikatz.exe or powershell -enc.Detection & Response
- Audit RMM Access: MSPs must enforce strict access controls on their RMM platforms, including mandatory MFA, IP allowlisting, and role-based access control (RBAC).
- Log Everything: Ingest all RMM logs (access, commands executed, sessions) into a SIEM for monitoring and alerting on suspicious patterns.
- Assume Breach: Given the statistics, SMBs should operate under the assumption that some of their users are compromised and focus on identity security, endpoint detection, and segmentation to limit the blast radius.
- AI-Powered Defense: The report makes a strong case for adopting security tools that leverage AI for detection and response to keep pace with AI-driven attacks.
Mitigation
- Harden RMM Tools: MSPs must treat their RMM platform as their most critical, sensitive asset. It should be hardened, patched, and monitored relentlessly.
- Phishing-Resistant MFA: Implement phishing-resistant MFA (e.g., FIDO2) for all users, especially privileged accounts at both the MSP and SMB level.
- Endpoint Detection and Response (EDR): Deploy EDR on all managed endpoints to detect malicious behavior, even when it originates from a trusted process like an RMM agent.
- Security Awareness Training: Continuous training is necessary to help employees spot sophisticated, AI-generated phishing attempts.
Timeline of Events
MITRE ATT&CK Mitigations
Multi-factor Authentication
Enforce phishing-resistant MFA on all MSP administrative accounts and RMM platforms.
Continuously audit RMM logs for suspicious activity, such as off-hours access or commands.
Behavior Prevention on Endpoint
Use EDR to detect and block malicious behaviors, even when they originate from a trusted RMM process.
Privileged Account Management
Apply the principle of least privilege to RMM access, ensuring technicians only have the access they need.
D3FEND Defensive Countermeasures
MSPs must treat their RMM platform logs as a critical source of security telemetry. By implementing Resource Access Pattern Analysis, an MSP can baseline normal administrative behavior. This involves analyzing which technicians access which clients, at what times, and from which IP addresses. The system can then alert on deviations, such as a technician who normally only services healthcare clients suddenly accessing a financial client, or an RMM session being initiated at 3 AM from an unrecognized IP. This behavioral approach is essential for detecting the abuse of legitimate credentials and tools like ScreenConnect.
Mandatory, phishing-resistant Multi-factor Authentication is the single most important control for protecting RMM platforms. MSPs should disable all legacy authentication methods and enforce the use of FIDO2 security keys or similar strong authenticators for all administrative staff. This control directly mitigates the risk of credential theft via phishing, which is a primary entry vector for attackers. By making it impossible for an attacker to log in with just a stolen password, the entire supply chain attack chain can be broken at the first step.
On the client endpoint, EDR tools must be configured to perform deep process analysis on the RMM agent itself (e.g., ScreenConnect.ClientService.exe). While the agent is a trusted process, its child processes are not. EDR rules should be created to alert on or block the RMM agent from spawning suspicious child processes like powershell.exe, cmd.exe, cscript.exe, or any known credential dumping tools. This 'parent-child process relationship' analysis is key to detecting 'Living Off the Land' attacks where the attacker is using the RMM tool's own functionality to execute malicious commands.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.