Small businesses are actually the most common ransomware targets by volume, even though many owners assume attackers go after large enterprises. In reality, a 20 to 30 person company hits the ideal balance for an attacker. There is enough revenue to justify the effort, no dedicated security team in place, and plenty of public information available to research in under an hour.
What follows is a step by step walkthrough of how a small business gets compromised, written from the attacker’s perspective. The company described is fictional, but the methods are consistent with current threat intelligence. After the walkthrough, you will see five clear points where this attack could have been stopped using controls that most small businesses already have.
Monday: how I picked you
I run a structured operation with a manageable workload. I track about 40 potential targets per month and focus on companies with 10 to 50 employees. That range offers the best return. Larger companies have security teams and legal support that complicate recovery. Smaller businesses often are not worth the effort. A 22 person company has the right mix of revenue, internal data, and urgency to recover operations quickly.
I did not discover you through a breach. I found you through public records. Business registries, government contracts, and licensing databases provide enough information to identify your company, estimate your size, and determine who inside your organization is most valuable to target.
Nothing going wrong at your company is actually a signal. It suggests credentials are still valid, staff is not on high alert, and no one has recently been forced to change passwords.
Tuesday: mapping your organization
Within about 40 minutes, I can build a basic org chart using only public sources.
LinkedIn shows current employees and job roles. Your office manager has been handling accounts payable, payroll, and invoicing for years. You list yourself as the owner, with a limited presence, which makes you less likely to notice unusual activity around your account.
Other public posts and listings fill in the gaps. I now know who handles money, what systems you likely use, and who can approve payments.
That person becomes my target. They have access, authority, and enough daily workload that a single extra email is less likely to stand out.
Wednesday: buying your credentials
I search underground marketplaces for credential dumps tied to your email domain. These are collected by infostealer malware and sold cheaply.
Two matches come back. One includes your office manager’s work email and password. The other appears tied to a personal account connected to your household or business.
I pay $14.
The password is not unique. It appeared in a prior breach and was never changed. Variations of it work across multiple services, including your Microsoft 365 account. The only barrier left is MFA.
Thursday: getting around MFA
MFA works, but only when implemented correctly.
Push notifications alone are harder to exploit now because Microsoft added number matching, but attackers have adapted. I use an adversary in the middle phishing attack. The login page looks legitimate, but it sits behind a proxy I control.
When your office manager signs in and approves the prompt, I capture the session token. Microsoft sees a valid login. I end up with full access.
As a backup, I also tried a phone call earlier in the day posing as your IT provider using a name I found online. If needed, I could prompt approval that way.
By the end of the day, I am inside the account. I create an inbox rule to forward emails silently and begin monitoring.
Friday afternoon: why I waited
I do not act immediately. I spend about a day and a half reviewing emails to understand your financial position and urgency.
I find your insurance details, bank balances, customer data, and upcoming deadlines. This tells me exactly what you can afford and how quickly you need to recover.
I set the ransom accordingly. High enough to matter, low enough to get paid.
I deploy encryption late Friday afternoon. Key staff are unavailable, leadership is offsite, and response time is delayed. By the time anyone reacts, operations are down.
My total cost was $14 and several hours of effort.
Where this attack would have failed
This scenario worked because several basic controls were missing. None of them are expensive, and most are already included in tools many businesses use.
- Password reuse
Enforcing unique passwords and blocking known compromised ones would have made the stolen credentials useless. Tools like Entra password protection and password managers solve this. - Phishing resistant MFA
Methods like FIDO2 keys, passkeys, or Windows Hello prevent session token theft. Conditional Access policies and Defender for Office 365 would also reduce the risk. - External email forwarding
Blocking forwarding rules at the tenant level would have prevented ongoing access to email. - Alert monitoring
Security tools already flag suspicious actions like new forwarding rules. Someone reviewing those alerts could have stopped the attack early. - Public exposure of roles
Public data is unavoidable, but oversharing responsibilities makes targeting easier. Limiting detail in profiles can reduce risk.
Three questions to ask your IT provider
- Are we using phishing resistant MFA for critical accounts
- Is external email forwarding blocked at the tenant level
- Are our security alerts monitored and reviewed
FAQs
Do attackers really target small businesses?
Yes. Small and mid sized companies are often preferred targets because they offer a strong return with fewer defenses.
What is an adversary in the middle attack?
It captures login sessions by placing a proxy between the user and the real service, allowing the attacker to hijack authenticated sessions.
What is a stealer log?
A package of credentials collected by malware and sold on underground markets, often for a very low cost.
How expensive is an attack like this?
In many cases, the upfront cost is minimal. The barrier to entry is very low.
Could this have been stopped with tools I already have?
In many cases, yes. Most of the controls described are already included in common Microsoft 365 licensing and simply require proper configuration and monitoring.