What is managed-service-provider compromise?¶

Managed-service-provider compromise occurs when an offender abuses access, accounts or tools belonging to a provider that administers customer environments.

Evidential caution: that activity from a trusted provider account is legitimate or that the provider itself intended the action.

What this means¶

A compromised provider may give access to:

remote management;

software deployment;

backup systems;

administrator accounts;

monitoring platforms;

identity services;

customer networks;

support portals.

which provider account or platform was used;

which customer systems were reached;

what commands or deployments occurred;

which operator or session initiated them;

whether the provider account was compromised;

which customers were affected;

what provider-side records survive.

Customer endpoints may show only a trusted service account or management agent.

Managed providers may use shared administrative platforms across many customers. Preserve customer identifiers, tenant boundaries, operator roles and job targeting. One compromised provider account may reach several organisations, but the effect and evidence for each customer should still be assessed separately.

Provider-side containment can also alter customer evidence. Disabling accounts, deleting jobs or rotating credentials may be necessary, but the timing and effect should be documented. Customer and provider timelines should be aligned so later gaps are not wrongly attributed to the offender. The operational takeaway is:

Trace activity from provider account to management job to customer effect, and distinguish trusted-service abuse from deliberate provider participation.

================================================================================

What to check or do next¶

• Investigators should establish:
• Preserve upstream provider records, including authentication, job creation, approvals, scripts and customer targeting.
• Do not treat the provider employee named on an account as the person responsible without device and session evidence.

Evidential limits¶

It may not be.