Small businesses are the most common small business ransomware target by volume of incidents — even though many small business owners assume hackers focus on larger organizations. A 22-person company has enough revenue to be worth attacking, no dedicated security team to defend it, and a publicly traceable footprint that takes about an hour to research. The return per hour for an attacker is better at this size than at either extreme.

What follows is a step-by-step walkthrough of how a small business gets attacked, written from the attacker’s side. The company in this account is composite, but the methods are accurate to current threat intelligence reporting. After the walkthrough, you’ll see five specific points where the attack would have been stopped by controls that come bundled with security tools most Southeast Texas small businesses already pay for.

Small Business Ransomware Starts on Monday: How the Target Gets Picked

Ransomware operators run volume operations with spreadsheets of 40 or more prospects per month. The preferred target range is 10 to 50 staff — large enough to have payroll, customer databases, and project files worth encrypting, small enough to lack a dedicated security team. A 22-person commercial services company sits in the right zone: the owner will pay to get the lot back, and the return per hour beats both large enterprises and sole traders.

Targets are found on public business records portals. State business registries, federal contract awards, and county-level licensing databases publish enough detail to identify the company, look up the owner’s name, estimate revenue, and identify the most useful person inside the business. One search can return the company name, registered agent, the contract value of a recent municipal job, and the named contact on the submission.

A company with a clean security record is the strongest small business ransomware signal an attacker looks for. It means credentials are probably still valid, staff hasn’t been trained to spot anything, and nobody has had a reason to change a password.

Tuesday: Building the Org Chart for Free

A 40-minute browser session reveals the attack surface in detail. LinkedIn lists current employees with job titles. A six-year office manager who lists “accounts payable, payroll, and supplier invoicing” in her profile is the obvious primary target — she has system access, handles supplier payments, and is busy enough that one more email doesn’t get scrutinized. Public business filings confirm the registered business name. A “meet the team” social post names staff with photos. Job listings on Indeed reveal the software stack (“experience with QuickBooks or Sage”).

The attacker now knows who handles the money, what their name is, how long they’ve been there, what software they use, and who in the business has the authority to approve a payment without a second signature. Total cost: $0.

Wednesday: Credentials Bought for $14

Stealer logs are credential packages harvested by infostealer malware that infected a personal device — often months or years earlier. The malware records every username and password typed into the machine, then bundles the data for sale on Telegram channels and underground forums.

In a typical small business ransomware preparation, searching the company’s email domain returns two results: the office manager’s work email with a browser-saved password, and a personal address belonging to a family member. The $14 package takes four minutes to purchase. The same HaveIBeenPwned database that security professionals use for free shows the password appeared in a retail loyalty program breach three years earlier — and hasn’t been changed since.

The family member’s credentials are more interesting. The same password, with minor variations, shows up across a streaming service, a gaming account, and the company’s Microsoft 365 login. The password works. The only thing between the attacker and the inbox is the second factor.

Total attacker spend: $14.

Thursday: Getting Past MFA

Multi-factor authentication stops many small business ransomware attacks — but the implementation matters more than the checkbox. Simple push-notification fatigue doesn’t work against accounts where Microsoft has enabled number matching (required since May 2023 for Microsoft Authenticator push notifications). The current dominant bypass is adversary-in-the-middle (AiTM) phishing.

The attacker sends the office manager an email designed to look like a routine Microsoft 365 password reset notification, citing the same breach her credentials appeared in. The link leads to a proxy page that mirrors the real Microsoft sign-in screen. When she enters her password and approves her MFA prompt, the proxy forwards both to the real Microsoft login server — which validates the credentials, completes the MFA challenge, and issues a session token back to the proxy. The attacker captures the token. She sees a normal login experience.

The attacker is now signed in as the office manager. Microsoft sees a valid authenticated session. The MFA prompt succeeded — the session token is just sitting in the wrong browser.

As a backup, the attacker also called the office posing as IT support, using a name found in a Google review left 18 months earlier. The receptionist said the office manager wasn’t at her desk. The call cost nothing. By Thursday night, an inbox forwarding rule is in place, copying all her emails to an address the attacker controls without notifying her.

Friday 2:47pm: Why the Attack Waits 36 Hours Before Encrypting

Dwell time is how small business ransomware operators size the ransom correctly. In 36 hours of reading forwarded email, the attacker finds: the cyber insurance policy with a $250,000 cyber liability sub-limit, a bank reconciliation showing the business account at roughly $180,000 at month end, the customer list in a quote template, and a message thread about a municipal project starting in three weeks with a hard deadline that can’t be missed.

The ransom is set at $65,000 in cryptocurrency — below 10% of visible liquid assets, low enough that the owner will pay rather than fight it, well within what’s accessible. The encryption payload deploys at 2:47pm on Friday. Timing is deliberate: the bookkeeper finishes at 3pm on Fridays, the owner is on a job site with their calendar synced to the shared inbox. By the time anyone understands what’s happened, it’s Friday evening, every file on the shared drive is encrypted, and a ransom note sits on every screen in the office.

Total attacker cost: $14 and about six hours of work spread across the week. The small business ransomware operation turns a profit of tens of thousands of dollars on that investment.

Five Places This Small Business Ransomware Attack Would Have Died

This small business ransomware attack worked because five ordinary things weren’t in place. None were expensive. Most were already bundled into security tools the business was paying for.

1. The Credential Purchase (Wednesday)

Microsoft Entra Password Protection can detect and block reused or commonly-compromised passwords across all accounts. Enforcing unique passwords through a password manager and through Entra’s policies makes a stolen credential purchase useless. The $14 small business ransomware credential package would have returned a working username attached to a blocked password.

2. The MFA Bypass (Thursday Night)

Number matching already blocked the simpler push-bombing small business ransomware attack. The AiTM session token theft has three defenses: phishing-resistant MFA (FIDO2 hardware keys, passkeys, or Windows Hello for Business), Conditional Access policies requiring a compliant or hybrid-joined device, and anti-phishing protection in Microsoft Defender for Office 365. Any one of these would have either prevented the session token capture or made the captured token unusable from an unrecognized IP address.

3. The Inbox Forwarding Rule (Thursday Night)

Microsoft 365 allows admins to block external email forwarding rules — one of the most overlooked small business ransomware defenses — at the tenant level. With that configuration in place, the forwarding rule that provided 36 hours of email intelligence would not have worked. Without that intelligence, the ransom would have been set blind — or the attack might not have been worth completing.

4. The 36-Hour Dwell Time (Thursday–Friday)

Microsoft Defender for Business, included in Microsoft 365 Business Premium, generates a small business ransomware-relevant alert when a new inbox forwarding rule is created. If those alerts were going somewhere visible and someone was reviewing them, the attacker would have been detected Thursday night — before the encryption payload ever deployed. The most impactful improvement for a small business is rarely a new product purchase. It’s turning on the alerts that the tools you’re already paying for are already generating, and making sure someone is watching them.

5. The Public Business Records (Monday)

For small business ransomware targeting, state contracting registries and federal contract awards stay public — that data can’t be unpublished. What can be controlled is what staff posts about their specific financial responsibilities. The office manager’s LinkedIn profile listing “accounts payable, payroll, and supplier invoicing” in her summary made her the obvious target. A brief conversation with the team about what to include versus omit in public professional profiles is a security awareness step that costs nothing.

Three Questions to Ask Your IT Provider

These three questions cover most of where the example small business ransomware attack failed — and apply to every Southeast Texas business in the 10-to-50-staff range. Each corresponds to a control that comes bundled with security tools most Southeast Texas businesses already pay for:

• Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and executive logins?
• Is external email forwarding blocked at the tenant level in our Microsoft 365 environment?
• Are our security alerts going somewhere, and is someone reviewing them?

If the answer to any of these is “I’m not sure,” that’s worth finding out before a small business ransomware incident makes it urgent. Our managed IT services for Southeast Texas businesses include a review of all three — schedule a free IT checkup to get started.

Frequently Asked Questions: Small Business Ransomware

Do hackers target small businesses? Yes. Most small business ransomware operations target small and mid-sized businesses because the ratio of payout potential to defensive resources is better than at either extreme of company size. The volume sweet spot is roughly 10 to 50 staff — enough assets to encrypt, but no dedicated security team defending them.

What is adversary-in-the-middle (AiTM) phishing? AiTM phishing uses a proxy page that mirrors a real login screen. When the user enters credentials and approves the MFA prompt, the proxy captures the resulting session token. The legitimate service treats the login as successful, but the token ends up in the attacker’s browser. AiTM has become the dominant credential-based attack vector against Microsoft 365 tenants after number matching ended simpler push-bombing.

What is a stealer log? A package of credentials harvested by infostealer malware from an infected personal device. The logs include browser-saved passwords, session cookies, and stored tokens, and are sold on underground markets for $10 to $20 per package. The malware typically infects personal computers through pirated software or malicious browser extensions.

How much does it cost an attacker to compromise a small business? In the small business ransomware walkthrough above, the total spend was $14 for stolen credentials and about six hours of work. Costs vary, but the threshold to attempt the kind of small business ransomware attack described here sits well below $100.

Are the controls that would have stopped this attack expensive? No. External forwarding restrictions and Defender for Business alerts are configuration changes, not new purchases. HaveIBeenPwned is free. Phishing-resistant MFA hardware keys are a small per-user cost compared with the cost of a successful ransomware incident. Most of these controls come bundled with Microsoft 365 Business Premium licenses that businesses in this size range typically already hold.

Article used with permission from The Technology Press.