How Small Business Ransomware Attacks Work (And How to Protect Against Them)

Article Summary: Small business ransomware is a volume business. Attackers work through dozens of prospects a month, and a 22-person company can be researched in 40 minutes using public records, breached through a single phishing click, and held for ransom within a week. Below is a day-by-day walkthrough of how that attack unfolds, told from the attacker’s point of view, followed by the five controls that would have stopped it. Most of them come bundled with security tools small businesses already pay for.

Many small business owners assume hackers go after big corporations. In reality, small and mid-sized businesses account for the bulk of ransomware incidents. A 22-person company has enough revenue to be worth attacking, no dedicated security team to defend it, and a public footprint that takes about an hour to research.

At Pacific Edge Technology, we work with businesses across Richland, Kennewick, and Pasco, and we see versions of this pattern again and again. What follows is a step-by-step walkthrough of a small business ransomware attack, written from the attacker’s side. The company is a composite, but the methods reflect current threat intelligence reporting. After the walkthrough, you’ll see five specific points where the attack would have failed.

Monday: how I picked you

I keep regular hours and run a volume operation. My spreadsheet holds about 40 prospects a month, and I prefer businesses with 10 to 50 staff. The reason is economics. Large enterprises have security teams, incident response contracts, and lawyers, which makes the job expensive for me. Sole proprietors rarely have enough at stake to bother with. A 22-person commercial services company sits right in the middle: payroll, a customer database, project files, supplier relationships, and an owner who will pay to get it all back.

I didn’t find you through a breach or a tip. I found you on a public records portal. State business registries, government contract awards, and county licensing databases publish enough detail for me to identify your company, look up your name, estimate your revenue, and pick the most useful person inside your business. One search gave me your company name, your registered agent, the value of a recent municipal contract, and the named contact on the bid.

The fact that nothing has gone wrong at your company yet is the strongest signal I get. It tells me your passwords probably haven’t changed, your staff hasn’t been trained to spot anything, and nobody has had a reason to tighten things up.

Tuesday: building your org chart for free

I spend about 40 minutes researching your company today, using nothing but a web browser.

LinkedIn gives me eight of your current employees and their job titles. Your office manager has been with you for six years and lists “accounts payable, payroll, and supplier invoicing” in her profile. Your second admin joined 14 months ago. Your own profile is sparse with few connections, which tells me you’re unlikely to notice anything unusual happening on LinkedIn or your company’s social media.

Public filings confirm your registered business name and your full legal name. A “meet the team” post on your Facebook page from two years ago shows first names and photos. Your job ads on Indeed mention “experience with QuickBooks,” so I know what accounting software your office runs.

Now I know who handles your money, how long she’s been there, what software she uses, and that you are the one who approves payments. You’re harder to reach and probably more cautious. Your office manager is the better target. She has system access, handles supplier payments, and is busy enough that one more email in her inbox won’t get a second look.

I haven’t spent a dollar yet.

Wednesday: I bought your password for $14

Stealer logs are bundles of usernames and passwords harvested by malware that infected someone’s personal computer, often months or years earlier. The malware records every saved and typed password on the machine and packages the data for sale. Marketplaces on Telegram and underground forums let buyers search these logs by company email domain.

I search for your company’s domain and get a hit: your office manager’s work email, with a password saved in the browser on her home laptop. I pay $14 for the package. It takes four minutes.

Her password follows a common pattern: a pet’s name, a year, and an exclamation mark. It also appeared in a retail loyalty program breach three years ago, and she never changed it. I try it on your Microsoft 365 login page. It works. The only thing between me and her inbox is multi-factor authentication.

Total spend so far: $14.

Thursday: getting past your MFA

Multi-factor authentication stops a lot of attacks, but how it’s set up matters more than whether it’s turned on.

Bombing her phone with approval requests won’t work. Microsoft turned on number matching by default for all Microsoft Authenticator push notifications in May 2023, so she would have to type in a number shown on the login screen instead of just tapping “approve.”

What still works is adversary-in-the-middle (AiTM) phishing. I send her an email that looks like a routine Microsoft 365 password reset notice, referencing the real breach her password appeared in. The link takes her to a page that looks exactly like the Microsoft sign-in screen. It’s actually a proxy I control.

When she enters her password and completes the MFA prompt, my proxy passes everything through to the real Microsoft login. Microsoft verifies her, completes the MFA check, and issues a session token, which my proxy captures. She sees a normal login followed by a “password updated successfully” message.

I’m now signed in as her. Microsoft sees a valid, fully authenticated session and treats everything I do as legitimate.

I had a backup plan in case she didn’t click. Earlier that day, I called your office pretending to be your IT company, using a name I found in a Google review you left 18 months ago. I told your receptionist we’d seen unusual login activity on the office manager’s account and that she would need to read me a verification number in the next few minutes. The receptionist said she wasn’t at her desk. I said no problem, I’d call back. The call cost me nothing.

By Thursday night, I’m inside her Microsoft 365 account. I set up a hidden rule that forwards copies of her email to an outside address I control. Then I wait.

Friday 2:47pm: why I waited 36 hours before encrypting

I spend 36 hours reading email before I encrypt anything. That’s how I set the ransom at the right price.

In that time, I find your cyber insurance policy attached to an email from your broker, with a cyber liability limit of $250,000. A bank reconciliation your office manager sent you two weeks ago shows about $180,000 in your business account. Your customer list is in a quote template she emailed to herself, and a thread with a municipal project manager mentions a job starting in three weeks with a deadline you can’t afford to miss.

I set the ransom at $65,000 in cryptocurrency. That’s low enough that paying looks easier than fighting, high enough to be worth my time, and comfortably within what I know you can access between your bank balance and your insurance.

I launch the encryption at 2:47pm on Friday. The timing is deliberate. Your office manager leaves at 3pm on Fridays, which I learned from an out-of-office reply. Your calendar invites show you’ll be on a job site all afternoon. The person most likely to notice something wrong is already gone, and the person who can make decisions is out of reach.

By the time anyone realizes what happened, it’s Friday evening, every file on your shared drive is encrypted, and a ransom note is on every screen in your office.

Total cost to me: $14 and about six hours of work spread across the week.

Five places this small business ransomware attack would have failed

This attack worked because five ordinary safeguards weren’t in place. None of them are expensive, and most are already included in tools you likely pay for.

1. The password purchase on Wednesday

A unique password for every account, stored in a password manager, makes a stolen password from an old breach useless. HaveIBeenPwned is a free way to check whether your company’s email addresses have shown up in known breaches. Microsoft Entra Password Protection can also block weak and commonly used passwords across your organization.

2. The MFA bypass on Thursday

Number matching already stops the simpler push-bombing attack. The bigger threat today is adversary-in-the-middle phishing. Defenses include phishing-resistant MFA (FIDO2 security keys, passkeys, or Windows Hello for Business), Conditional Access policies that only allow sign-ins from company-managed devices, and the anti-phishing protection in Microsoft Defender for Office 365. Any one of these would have either stopped the session token from being captured or made it useless on my computer.

3. The email forwarding rule

Microsoft 365 lets administrators block automatic forwarding to outside email addresses for the whole organization. With that block in place, I couldn’t have quietly read 36 hours of email. I might have encrypted anyway, but I would have been guessing at the ransom amount.

4. The 36 hours I spent inside

Microsoft 365 can alert administrators when someone creates a suspicious forwarding rule, and Microsoft 365 Business Premium adds Defender for Business and Defender for Office 365 for broader threat detection. If anyone had been watching those alerts, I would have been caught Thursday night. For a business your size, the most impactful improvement is rarely a new product. It’s making sure someone actually reviews the alerts your existing tools already generate. This is exactly the kind of ongoing monitoring Pacific Edge Technology provides for our clients, so warnings like this don’t sit unread.

5. The public information

You can’t remove your business from state registries or public contract awards. What you can control is how much detail your team shares about their roles online. Your office manager’s LinkedIn profile spelled out her financial responsibilities, which made her the obvious target. That’s worth a friendly conversation with your team, framed as practical security awareness rather than a rule about what people can post.

Three questions to ask your IT provider

These three questions cover most of the places this attack could have been stopped. Each one relates to a control that comes with security tools you most likely already pay for.

1. Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and owner logins?
2. Is automatic forwarding to outside email addresses blocked for our organization?
3. Where do our security alerts go, and who is reviewing them?

If you’re a Tri-Cities business and aren’t sure how your provider would answer, get in touch with Pacific Edge Technology. We’re happy to walk through your setup and show you where the gaps are before an attacker finds them.

Small Business Ransomware FAQs

Do hackers really target small businesses?

Yes. Small business ransomware is common because the potential payout is high compared to how well most small businesses are defended. Companies with roughly 10 to 50 employees are a sweet spot: they have valuable data and money, but usually no dedicated security staff.

What is adversary-in-the-middle (AiTM) phishing?

It’s a technique where the attacker sets up a fake login page that passes everything through to the real one, such as Microsoft 365 or Google Workspace. When the user enters their password and completes MFA, the attacker captures the session token that proves the user is logged in. The real service sees a successful login, but the attacker now has a working session. AiTM has become one of the most common ways attackers get around MFA on Microsoft 365.

What is a stealer log?

A stealer log is a package of passwords, browser cookies, and login tokens collected by malware from an infected computer. These logs sell on underground markets for roughly $10 to $20 each. The malware usually gets onto personal computers through pirated software or malicious browser extensions.

How much does it cost an attacker to break into a small business?

In the example above, the attacker spent $14 on a stolen password and about six hours of work. Costs vary, but launching this kind of attack typically costs well under $100.

Can tools I already have stop a small business ransomware attack?

Often, yes. Many of the controls in this article are included in Microsoft 365 Business Premium, which many businesses this size already have. Blocking outside forwarding and turning on security alerts are settings changes, not new purchases. HaveIBeenPwned is free, and phishing-resistant security keys cost very little per person compared with a ransomware incident. Pacific Edge Technology can help you check which of these protections you already have in place.

Article used with permission from The Technology Press.