Cybercriminals aren’t just evolving – they’re accelerating. With tactics growing more sophisticated and attacks more frequent, Managed Services Providers (MSPs) are under immense pressure to defend their clients against a threat landscape that shifts by the day. From ransomware-as-a-service to AI-enhanced phishing and stealthy malware, today’s cyberthreats are more accessible, more targeted and more damaging than ever.
To stay ahead, MSPs must understand the eight most critical threats currently impacting businesses. These aren’t just theoretical risks – they’re active, measurable and already affecting organizations across industries. Here’s what every MSP needs to be watching:
- Ransomware. This remains the single most persistent and damaging threat with attackers leveraging common ransomware-as-a-service (RaaS) tools – like LockBit, ALPHV (BlackCat) and Rhysida – making it alarmingly easy for even non-technical criminals to launch attacks. The widespread use of RaaS has fueled explosive growth: Barracuda Managed XDR data shows a fourfold increase in ransomware campaigns across 2024. Healthcare and municipalities are frequent targets, but no industry is immune.
- Phishing. The largest companies see the highest total attack volume, but on a per mailbox basis, small companies are hit hardest – averaging six attacks per mailbox versus one at larger firms. Business Email Compromise (BEC) and conversation hijacking are pervasive across all sizes, while extortion and classic phishing disproportionately hit the smaller targets.
- Bad bots that automate malicious activity and increasingly mimic human behavior to evade detection. While the absolute number of bots online has climbed, smarter, more targeted bot attacks now make up a smaller share of overall traffic. Economic downturns have led to a dip in mass “shopping bot” activity (e.g., ‘sneaker-bots’ hunting limited edition shoes), but the bots you do encounter are more effective, dangerous and harder to identify.
- Extortion and sextortion. Extortion demands are increasing, sometimes reaching thousands of dollars. These tactics are becoming significantly more effective, as cybercriminals now utilize personal data such as full names, phone numbers, and even Google Maps screenshots to enhance their credibility. Bitcoin sextortion scams, which now account for 12% of all malicious PDF attachments, are an emerging trend. This approach is employed to evade detection, since many attachment scanners do not analyze ‘benign’ text within attachments but instead search for malicious payloads. In such attacks, cybercriminals dispatch emails containing PDFs that falsely claim to possess compromising information about their victim, often alleging hacked webcam footage or stolen browsing history. The PDFs contain threatening messages demanding Bitcoin payments to prevent the release of his supposed evidence. These scams rely on fear and urgency to manipulate victims into paying, even when no genuine compromise has taken place.
- Brand impersonation. These attacks are on the rise, especially those impersonating prominent technology companies. For example, the readily available advanced phishing-as-a-service (PhaaS) kit, Tycoon, makes it easy to create impersonation attacks by employing techniques designed to obscure, muddle and disrupt the structure of links, thereby confusing automated detection systems and preventing the links from being blocked. Recently, Redundant Protocol tactics used in a Tycoon attack were seen impersonating Microsoft 365. In another instance, one widespread campaign claimed to require users to update payment information for ChatGPT to avoid the cancellation of a monthly subscription. The email closely resembled a legitimate communication from OpenAI but relied on an obfuscated hyperlink, and the actual URL differed from one email to another.
- Malware. Today’s infostealer malware does much more than steal passwords. Attacks now target PDFs, browser data, Bitcoin extension wallets, web histories, and more, sending all harvested data to remote sites or email accounts.
- QR code attacks. Cybercriminals increasingly use malicious QR codes (“quishing”), often hidden in seemingly innocuous attachments like PDFs. Barracuda recently detected half a million such attacks in just three months.
- URL compromise. Sophisticated attackers are now creating QR codes with text-based ASCII/Unicode, or using “Blob URLs” embedded in browsers. These sidestep traditional security tools that rely on URL scanning or optical recognition.
Making protection actionable
Safeguarding against these threats, including the continuous evolution of existing ones, requires fundamental security done exceptionally well, alongside modern, layered defenses.
When new attack types emerge, MSPs can uniquely help customers respond – by reinforcing top-tier cybersecurity hygiene, deploying the latest prevention and detection solutions and being the trusted resource for security advice. Some best practices MSPs can follow include:
- Cultivating a client-wide “security-first culture” using engaging, continuous awareness training.
- Standardizing on a comprehensive email security platform with advanced threat detection, AI-driven impersonation protection, cloud-based backup and rapid automated incident response.
- Ensuring backup/restore systems feature strong encryption, redundancy and fast recovery capabilities.
- Helping clients automate patches and updates – unpatched software and devices remain the easiest targets.
- Providing web and application protection (on-prem and cloud) and 24×7 monitoring.
For MSPs, it is important to stay vigilant, keep evolving – and enable their clients to do the same. For more information on the latest cyberthreats and how to protect your business and that of your customers from evolving attacks, check out the Barracuda e-Book, 8 key threats to protect against now.
