Small businesses are the most common ransomware targets by total number of incidents, even though many owners still assume cybercriminals focus primarily on large organizations.
A company with 22 employees can be an ideal target. It has enough revenue and valuable data to make an attack worthwhile, but it may not have a dedicated security team to defend it. Its public footprint can often be researched in less than an hour.
This walkthrough explains how a small business can be attacked from the cybercriminal’s point of view. The company described is a composite, but the methods reflect current attack patterns and threat intelligence reporting.
After the walkthrough, we will identify five specific points where the attack could have been stopped by security controls that are often already included with tools small businesses pay for.
Monday: how I picked you
I work regular hours and run a relatively small operation. My spreadsheet contains approximately 40 potential targets each month, and I prefer businesses with between 10 and 50 employees.
That range is intentional.
Large enterprises usually have internal security teams, incident response contracts, legal departments, and mature recovery processes. Those defenses make the attack more difficult and expensive for me.
At the opposite end, sole proprietors rarely have enough data, revenue, or operational pressure to make the effort worthwhile.
A 22-person commercial services company falls directly in the middle. It has payroll information, customer records, project files, supplier relationships, and an owner who may be willing to pay quickly to restore access.
The return for each hour of work is often better at this size than at either extreme.
I did not discover your company through a confidential tip or a previous data breach. I found it through a public business records portal.
State business registries, federal contract award databases, and county licensing records publish enough information for me to identify your company, find the owner’s name, estimate revenue, and determine which employee may be the most useful target.
One search revealed your company name, registered agent, the value of a recent municipal contract, and the employee listed as the primary contact on the submission.
The fact that your company has never experienced a major cyber incident is one of the strongest signals available to me.
It suggests that employee credentials may still be valid, staff may not have received practical security training, and no one has had an urgent reason to change passwords or review access.
A clean history is often the first indicator I look for.
Tuesday: building your org chart for free
Today, I spend approximately 40 minutes researching your company using only a web browser.
LinkedIn gives me the names and job titles of eight current employees.
Your office manager has worked at the company for six years and lists “accounts payable, payroll, and supplier invoicing” in her profile summary. A second administrator joined approximately 14 months ago.
You identify yourself as the company director, but your profile is limited and you have a relatively low connection count. That suggests you may be less likely to notice when an unfamiliar person begins interacting with your profile or the company’s social media pages.
Public business filings confirm your registered company name and full legal name.
A “meet the team” post from two years ago on your Facebook page provides employee first names and photos. One person is described as helping in the office a few days each week, and one of the commenters shares your surname.
I now know who manages company finances, how long she has worked there, and which accounting platform she may use. I can confirm the software by reviewing previous job advertisements for phrases such as “experience with QuickBooks or Sage.”
I also know who has the authority to approve a payment without requiring a second signature.
That person becomes my primary target.
You may be harder to reach and more cautious. Your office manager has access to important systems, handles supplier payments, and receives enough email that one additional message may not receive close scrutiny.
I still have not spent any money.
Wednesday: I bought your credentials for $14
Stealer logs are collections of login credentials captured by infostealer malware on an infected device, often months or years before the credentials are sold.
The malware records usernames and passwords entered on the device and packages the information for resale. Marketplaces operating through messaging channels and online forums allow buyers to search available records by a company’s email domain.
I search for your company’s email domain and receive two results.
The first contains your office manager’s work email address and a password that appears to have been stored in her browser.
The second contains a personal Gmail address that seems to belong to one of your family members, possibly collected from a device connected to the same home network.
I pay $14 for the package. The purchase takes four minutes.
Your office manager’s password follows a common pattern: the name of a pet or child, followed by a year and an exclamation point.
I check it against Have I Been Pwned, the same free breach database used by security professionals, and discover that the password appeared in a credential dump from a retail loyalty program breach three years ago.
The password has not been changed since.
Your family member’s credentials become more useful after further review.
The same password, with minor variations, appears across a streaming platform, a gaming account, and your company’s Microsoft 365 login.
The password works. The only remaining barrier between me and the inbox is the second authentication factor.
Total spend so far: $14.
Thursday: getting past your MFA
Multifactor authentication prevents many attacks, but the way it is implemented matters more than simply checking a box that says it is enabled.
A basic push-notification fatigue attack does not work against your office manager’s account.
Microsoft enabled number matching by default for Microsoft Authenticator push notifications in May 2023. Instead of simply tapping “Approve,” the user must enter a number displayed on the login screen.
That protection makes basic push bombing significantly less effective.
Adversary-in-the-middle, or AiTM, phishing can still work.
I send your office manager an email designed to resemble a routine Microsoft 365 password reset notification. The message references the same breach where I found her password earlier in the week.
The link directs her to a page that closely copies the legitimate Microsoft sign-in screen. However, the page is actually a proxy that I control.
When she enters her password and completes the MFA request, my proxy forwards both to Microsoft’s real login system.
Microsoft verifies the password, accepts the MFA approval, and returns an authenticated session token to the proxy. I capture that token.
Your office manager experiences what appears to be a normal Microsoft login and then sees a message stating that the password was updated successfully.
I am now signed in as her.
The MFA request was completed correctly, but the authenticated session token is stored in my browser rather than hers. Microsoft sees a valid session and initially treats my activity as legitimate.
I also prepared a backup plan in case she did not click the email.
Earlier that day, I called your office and pretended to be an employee of your IT support provider. I used a name found in a Google review your business posted approximately 18 months ago.
I told the receptionist that we had detected unusual activity involving the office manager’s account and that she would need to approve a verification request within the next few minutes.
The receptionist explained that the office manager was away from her desk. I said that was fine and that I would try again later.
The call cost me nothing.
By Thursday evening, I have access to the office manager’s Microsoft 365 account.
I create an inbox forwarding rule that silently sends copies of her messages to an email address I control. Then I wait.
Friday 2:47pm: why I waited 36 hours before encrypting
I spend 36 hours reading email before encrypting any files.
That delay allows me to determine how much ransom your business is likely to pay.
During those 36 hours, I find your cyber insurance policy attached to an email from your broker. It includes a cyber liability sub-limit of $250,000.
A recent bank reconciliation shows that your business had approximately $180,000 in its operating account at the end of the month.
Your customer list appears in a quotation template the office manager emailed to herself. An email thread with a municipal project manager describes a project beginning in three weeks with a deadline the company cannot afford to miss.
I set the ransom at $65,000 in cryptocurrency.
That amount is low enough that paying may seem easier than fighting, but high enough to make the attack worthwhile. It is also within the range I know your company can access.
Ransom demands greater than approximately 10% of visible liquid assets are more likely to be disputed. The amount I selected remains below that level.
I deploy the encryption payload at 2:47 p.m. on Friday.
The timing is deliberate.
Your bookkeeper leaves at 3:00 p.m. on Fridays, which I learned from an out-of-office reply in the forwarded messages.
You are working at a job site, and your calendar is synchronized with the shared inbox.
The employee most likely to notice a problem and call for help is about to leave. The person authorized to make major decisions is difficult to reach.
By the time anyone understands what has happened, it is Friday evening. Every file on the shared drive is encrypted, and a ransom note appears on every screen in the office.
Total cost to me: $14 for the credentials and approximately six hours of work spread across the week.
Five places this attack would have died
The attack succeeded because five ordinary protections were missing or not fully used.
None of them were especially expensive. Most were already included with security products the company was likely paying for.
1. The credential purchase on Wednesday.
Have I Been Pwned is free. Microsoft Entra password protection can identify and block commonly used or compromised passwords across company accounts.
Requiring a unique password for every account, supported by a business password manager and Entra password policies, would make a purchased credential far less useful.
2. The MFA bypass on Thursday night.
Microsoft already limits basic push-bombing attacks because number matching has been enabled by default for Microsoft Authenticator notifications since May 2023.
The more common credential-based bypass is now adversary-in-the-middle phishing.
Effective defenses include phishing-resistant MFA, such as FIDO2 security keys, passkeys, or Windows Hello for Business. Conditional Access policies can also require the user to sign in from a compliant or hybrid-joined device.
Anti-phishing protections in Microsoft Defender for Office 365 provide another layer of defense.
Any one of these controls could have prevented the session token from being captured or made the stolen token unusable from the attacker’s location and device.
3. The inbox forwarding rule.
Microsoft 365 administrators can block external email forwarding rules at the tenant level.
If that block had been enabled, the forwarding rule used to monitor 36 hours of email would not have worked.
The attacker may still have deployed ransomware, but the demand would have been based on guesswork rather than detailed financial information.
4. The 36-hour dwell time.
Microsoft Defender for Business, which is included with Microsoft 365 Business Premium, can generate an alert when a new inbox forwarding rule is created.
If someone had been monitoring those alerts, or if they had been routed to a visible and actively managed system, the attacker could have been detected on Thursday night.
For a company of this size, the most important security improvement is not always purchasing another product.
It is often ensuring that someone reviews and responds to the alerts generated by the tools already in place.
5. The public business records.
You cannot remove state contracting records, federal contract awards, or other legally required public information.
That information will remain available.
What employees can control is the level of detail they publicly share about their responsibilities.
The office manager’s LinkedIn profile described her financial duties clearly enough to make her the obvious target.
That is worth discussing with employees as part of practical security awareness training, rather than presenting it as a broad rule about what people are allowed to post.
Three questions to send your IT provider
These three questions address several of the weaknesses that allowed the example attack to succeed.
Each question relates to a control that may already be included with the security services or Microsoft 365 licensing your organization pays for.
- Are we using phishing-resistant MFA, such as FIDO2 security keys, passkeys, or Windows Hello for Business, for finance, administrator, and executive accounts?
- Is external email forwarding blocked at the Microsoft 365 tenant level?
- Where are our security alerts being sent, and who is responsible for reviewing and responding to them?
Article used with permission from The Technology Press.