How Small Business Ransomware Attacks Work (And How to Protect Against Them)

Article Summary: Small business ransomware is a volume business. Attackers work through dozens of prospects a month. They can research a 22-person company in 40 minutes, breach it with a single phishing click, and hold it for ransom within a week. Below is a day-by-day walkthrough of a small business ransomware attack, told from the attacker’s point of view. After it, you’ll find the five controls that would have stopped it. Most of them come bundled with security tools small businesses already pay for.

Many small business owners assume hackers go after big corporations. In reality, small and mid-sized businesses account for the bulk of ransomware incidents. A 22-person company has enough revenue to be worth attacking but no dedicated security team. Its public footprint takes about an hour to research.

At Pacific Edge Technology, we work with businesses across Richland, Kennewick, and Pasco. We see versions of this pattern again and again. What follows is a step-by-step walkthrough of a small business ransomware attack, written from the attacker’s side. The company is a composite, but the methods reflect current threat intelligence reporting. After the walkthrough, you’ll see five specific points where the attack would have failed. For the full picture of how to protect your business, see our guide to the top 10 small business cybersecurity best practices.

Monday: how I picked you

I keep regular hours and run a volume operation. My spreadsheet holds about 40 prospects a month, and I prefer businesses with 10 to 50 staff. The reason is economics. Large enterprises have security teams, incident response contracts, and lawyers, which makes the job expensive for me. Sole proprietors rarely have enough at stake to bother with. A 22-person commercial services company sits right in the middle. It has payroll, customer data, and project files, plus an owner who will pay to get it all back.

I didn’t find you through a breach or a tip. I found you on a public records portal. State business registries, government contract awards, and county licensing databases publish plenty of detail. With them, I can identify your company, estimate your revenue, and pick the most useful person inside your business. One search gave me your company name, your registered agent, the value of a recent municipal contract, and the named contact on the bid.

The fact that nothing has gone wrong at your company yet is the strongest signal I get. It tells me your passwords probably haven’t changed and your staff hasn’t learned what to watch for. Nobody has had a reason to tighten things up.

Tuesday: building your org chart for free

I spend about 40 minutes researching your company today, using nothing but a web browser.

LinkedIn gives me eight of your current employees and their job titles. Your office manager has been with you for six years and lists “accounts payable, payroll, and supplier invoicing” in her profile. Your second admin joined 14 months ago. Your own profile is sparse with few connections. That tells me you’re unlikely to notice anything unusual on LinkedIn.

Public filings confirm your registered business name and your full legal name. A “meet the team” post on your Facebook page from two years ago shows first names and photos. Your job ads on Indeed mention “experience with QuickBooks,” so I know what accounting software your office runs.

Now I know who handles your money and what software she uses. I also know you’re the one who approves payments. You’re harder to reach and probably more cautious. Your office manager is the better target. She has system access, handles supplier payments, and is busy enough that one more email in her inbox won’t get a second look.

I haven’t spent a dollar yet.

Wednesday: I bought your password for $14

Stealer logs are bundles of usernames and passwords harvested by malware that infected someone’s personal computer, often months or years earlier. The malware records every saved and typed password on the machine and packages the data for sale. Marketplaces on Telegram and underground forums let buyers search these logs by company email domain.

I search for your company’s domain and get a hit: your office manager’s work email, with a password saved in the browser on her home laptop. I pay $14 for the package. It takes four minutes.

Her password follows a common pattern: a pet’s name, a year, and an exclamation mark. It also appeared in a retail loyalty program breach three years ago, and she never changed it. I try it on your Microsoft 365 login page. It works. The only thing between me and her inbox is multi-factor authentication.

Total spend so far: $14.

Thursday: getting past your MFA

Multi-factor authentication stops a lot of attacks, but how it’s set up matters more than whether it’s turned on.

Bombing her phone with approval requests won’t work. Microsoft turned on number matching by default for Microsoft Authenticator in May 2023. Now she has to type in a number from the login screen instead of just tapping “approve.”

What still works is adversary-in-the-middle (AiTM) phishing. I send her an email that looks like a routine Microsoft 365 password reset notice. It’s polished, free of typos, and references the real breach her password appeared in. The link takes her to a page that looks exactly like the Microsoft sign-in screen. It’s actually a proxy I control.

When she enters her password and completes the MFA prompt, my proxy passes everything through to the real Microsoft login. Microsoft verifies her, completes the MFA check, and issues a session token, which my proxy captures. She sees a normal login followed by a “password updated successfully” message.

I’m now signed in as her. Microsoft sees a valid, fully authenticated session and treats everything I do as legitimate.

I had a backup plan in case she didn’t click. Earlier that day, I called your office pretending to be your IT company. I used a name from a Google review you left 18 months ago. I told your receptionist we’d seen unusual login activity on the office manager’s account. I said she’d need to read me a verification number soon. The receptionist said she wasn’t at her desk. I said no problem, I’d call back. The call cost me nothing.

By Thursday night, I’m inside her Microsoft 365 account. I set up a hidden rule that forwards copies of her email to an outside address I control. Then I wait.

Friday 2:47pm: why I waited 36 hours before encrypting

In most small business ransomware cases, the attacker reads before they encrypt. I spend 36 hours reading email before I touch anything. That’s how I set the ransom at the right price.

In that time, I find your cyber insurance policy attached to an email from your broker, with a cyber liability limit of $250,000. A bank reconciliation your office manager sent you two weeks ago shows about $180,000 in your business account. Your customer list sits in a quote template she emailed to herself. A thread with a municipal project manager mentions a job starting in three weeks, with a deadline you can’t miss.

I set the ransom at $65,000 in cryptocurrency. That’s low enough that paying looks easier than fighting, and high enough to be worth my time. It’s also well within what your bank balance and insurance can cover.

I launch the encryption at 2:47pm on Friday. The timing is deliberate. Your office manager leaves at 3pm on Fridays, which I learned from an out-of-office reply. Your calendar invites show you’ll be on a job site all afternoon. The person most likely to notice something wrong is already gone, and the person who can make decisions is out of reach.

By the time anyone notices, it’s Friday evening. Every file on your shared drive is encrypted, and a ransom note fills every screen in your office.

Total cost to me: $14 and about six hours of work spread across the week. And if your backups sit on the same network under the same admin password, I deleted those first.

Five places this small business ransomware attack would have failed

This small business ransomware attack worked because five ordinary safeguards weren’t in place. None of them are expensive, and most are already included in tools you likely pay for.

1. The password purchase on Wednesday

A unique password for every account, stored in a business password manager, makes a stolen password from an old breach useless. HaveIBeenPwned is a free way to check whether your company’s email addresses have shown up in known breaches. Microsoft Entra Password Protection can also block weak and commonly used passwords across your organization.

2. The MFA bypass on Thursday

Number matching already stops the simpler push-bombing attack. The bigger threat today is adversary-in-the-middle phishing. Good defenses include phishing-resistant MFA, such as FIDO2 security keys, passkeys, or Windows Hello for Business. Conditional Access policies that only allow company-managed devices help too, as does the anti-phishing protection in Microsoft Defender for Office 365. Any one of these would have either stopped the session token from being captured or made it useless on my computer. Training your team to spot scam emails that look real adds one more layer.

3. The email forwarding rule

Microsoft 365 lets administrators block automatic forwarding to outside email addresses for the whole organization. With that block in place, I couldn’t have quietly read 36 hours of email. I might have encrypted anyway, but I would have been guessing at the ransom amount. External forwarding is one of the Microsoft 365 security settings worth checking in any older account.

4. The 36 hours I spent inside

Microsoft 365 can alert administrators when someone creates a suspicious forwarding rule. Microsoft 365 Business Premium also adds Defender for Business and Defender for Office 365 for broader threat detection. If anyone had been watching those alerts, I would have been caught Thursday night. For a business your size, the most impactful improvement is rarely a new product. It’s making sure someone actually reviews the alerts your existing tools already generate. This is exactly the kind of ongoing monitoring Pacific Edge Technology provides for our clients, so warnings like this don’t sit unread.

5. The public information

You can’t remove your business from state registries or public contract awards. What you can control is how much detail your team shares about their roles online. Your office manager’s LinkedIn profile spelled out her financial responsibilities, which made her the obvious target. That’s worth a friendly conversation with your team, framed as practical security awareness rather than a rule about what people can post.

If small business ransomware does get through

Even strong defenses can fail, so two more safeguards matter. First, keep immutable backups that nobody can delete, not even an attacker with stolen admin credentials. With a clean backup, you can restore your files instead of paying.

Second, know exactly what to do in the first hour. Disconnecting the wrong way or replying from a hacked inbox can make things worse. Our step-by-step cyberattack response guide covers what to do and where Washington businesses must report an attack.

Three questions to ask your IT provider

These three questions cover most of the places your IT provider could have stopped this small business ransomware attack. Each one relates to a control that comes with security tools you most likely already pay for.

1. Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and owner logins?
2. Is automatic forwarding to outside email addresses blocked for our organization?
3. Where do our security alerts go, and who is reviewing them?

If you’re a Tri-Cities business and aren’t sure how your provider would answer, get in touch with Pacific Edge Technology. We’re happy to walk through your setup and show you where the gaps are before an attacker finds them.

Small Business Ransomware FAQs

Do hackers really target small businesses?

Yes. Small business ransomware is common because the potential payout is high compared to how well most small businesses are defended. Companies with roughly 10 to 50 employees are a sweet spot: they have valuable data and money, but usually no dedicated security staff.

What is adversary-in-the-middle (AiTM) phishing?

It’s a technique where the attacker builds a fake login page that passes everything through to the real one, like Microsoft 365. When the user enters their password and completes MFA, the attacker captures the session token that proves the user is logged in. The real service sees a successful login, but the attacker now has a working session. AiTM has become one of the most common ways attackers get around MFA on Microsoft 365.

What is a stealer log?

A stealer log is a package of passwords, browser cookies, and login tokens collected by malware from an infected computer. These logs sell on underground markets for roughly $10 to $20 each. The malware usually gets onto personal computers through pirated software or malicious browser extensions.

How much does it cost an attacker to break into a small business?

In the example above, the attacker spent $14 on a stolen password and about six hours of work. Costs vary, but launching this kind of attack typically costs well under $100.

Can tools I already have stop a small business ransomware attack?

Often, yes. Many of the controls in this article are included in Microsoft 365 Business Premium, which many businesses this size already have. Blocking outside forwarding and turning on security alerts are settings changes, not new purchases. HaveIBeenPwned is free, and phishing-resistant security keys cost very little per person compared with a ransomware incident. Pacific Edge Technology can help you check which of these protections you already have in place.

Article used with permission from The Technology Press.