Managed service providers (MSPs) are most attractive because they can act as a stepping stone for a larger set of victims. An MSP with 100 customers is considered mid-sized by a network intruder looking to sell credentials for admin accounts. Credentials belonging to executives, access to mail servers, to content management portals used by hospitals, law firms, and schools are all being sold. An unnamed U.S. tax company asked for $3,500 to give the keys to its internal network, from where attackers can access the company s more than 500,000 clients.
Source: https://www.bleepingcomputer.com/news/security/infiltrating-networks-easier-than-ever-due-to-evil-markets/