Article Summary: Ransomware attackers focus on small businesses by design. This walkthrough breaks down how a 22-person company gets researched, compromised, and encrypted in under a week for just $14, then identifies the five controls that would have stopped the attack at each stage.

Most ransomware incidents targeting small businesses share the same detail: the company didn't know the attack had started until it was already over. The attacker was quiet, methodical, and finished before anyone had a reason to look.

What follows is a reconstruction of how that sequence unfolds against a real company profile. The details are drawn from documented attack patterns and actual stealer log activity. Nothing in this walkthrough is hypothetical. The tools used at each stage are available to any attacker willing to spend a few hours and $14.

The goal isn't to describe the threat in general terms. It's to walk through every decision point in the attack chain and show exactly where a single control would have broken it, before a ransom note appears on every screen in the office.

Monday: How the Attacker Chose a Target

Ransomware operations are run like a business. I've reviewed enough incident reports to recognize the model: a managed list of prospects, a deliberate focus on companies between 10 and 50 employees, and a methodical approach to selecting targets based on economics. Here's why that size range is the sweet spot:

• Large enterprises carry dedicated security teams and incident response contracts that make attacks expensive to execute.

• Sole proprietors rarely generate enough revenue or data to justify the effort.

• A 22-person commercial services company sits in the ideal range. It has valuable payroll, customer records, project files, and supplier relationships worth encrypting, but no security team to resist an attack.

The initial research didn't come from a breach or a dark web tip. It came from public business records. State registries, federal contract awards, and county-level licensing databases publish more information than many business owners realize. They provide enough detail to identify a company, estimate its revenue, name the owner, and pinpoint the most valuable person inside the business. A single search surfaced the company name, registered agent, the value of a recent municipal contract, and the named contact on the submission.

The strongest indicator that a business is ready to target is a clean record. A lack of past security incidents often means credentials are still valid, employees haven't been through meaningful security training, and nobody has had a reason to change a password. A company with no history of security incidents isn't inherently safe. It's simply unguarded.

Tuesday: Mapping the Organization for Free

Forty minutes of open browser research produces a near-complete picture of the company's structure. Here's what the attacker pulled from publicly available sources:

• LinkedIn: Eight current employees, their job titles, and how long they've been with the company. The office manager's profile lists responsibilities like accounts payable, payroll, and supplier invoicing.

• Public business filings: The company's legal name, ownership information, and registered business details.

• Facebook: A "meet the team" post from two years ago includes employee names, photos, and mentions a part-time staff member.

• Indeed job postings: References to accounting software reveal what tools the business is likely using behind the scenes.

By the end of the session, the attacker knows who handles the money, what tools she uses, how long she's been in her role, and whether she can approve a payment without a second signature. That last detail makes her the primary target. The owner is harder to reach and likely more guarded. The office manager has system access, handles financial transactions, and stays busy enough that one more email in her inbox doesn't get scrutinized.

The attacker still hasn't spent a dollar.

Wednesday: Credentials Purchased for $14

Stealer logs are collections of stolen usernames and passwords harvested by a type of malware called an infostealer. The malware quietly records the login credentials entered on an infected personal device, then packages that information for sale on underground marketplaces. Buyers can search those databases by company email domain to see whether any employee credentials are available.

A search of this company's domain returns two results:

• The office manager's work email with a browser-saved password.

• A personal email address belonging to a family member of the owner, likely from a device on the same home network.

The package costs $14. The office manager's password follows a pattern commonly seen in post-incident reviews: a name combined with a year and a symbol. It appeared in a retail loyalty program breach three years earlier and hasn't been changed since. The family member's credentials are more useful than they first appear. The same password, with minor variations, shows up across a streaming account, a gaming account, and the company's Microsoft 365 login. The password works. The only remaining barrier is multi-factor authentication.

Thursday: Getting Through MFA

Multi-factor authentication is effective, but only as effective as how it's implemented.

Push-notification fatigue attacks don't work here. Microsoft enabled number matching for all Authenticator push notifications by default in May 2023, requiring users to type a code from their login screen rather than simply approve a tap. That closes the simpler path.

What does work is adversary-in-the-middle phishing. The attacker sends the office manager an email designed to look like a Microsoft 365 security notification, referencing the same breach where her credentials appeared. The process unfolds in four steps:

1. She clicks the link, which leads to a proxy page that mirrors the real Microsoft sign-in screen.

2. She enters her credentials and completes the MFA prompt.

3. The proxy forwards both to the real Microsoft server, which validates them and issues a session token.

4. The attacker captures that token. She sees a normal "password updated" confirmation.

The authentication worked exactly as designed. The session token just ended up in the wrong browser.

By Thursday night, the attacker is inside the office manager's Microsoft 365 account. A forwarding rule is set to copy all incoming email to an external address. Then the waiting begins.

Friday at 2:47 p.m.: Setting the Ransom

Over the next 36 hours, the attacker reads through the forwarded emails with one purpose: to set the ransom correctly. That process reveals:

• A cyber insurance policy with a liability sub-limit of $250,000.

• A bank reconciliation showing the business account has around $180,000 at month-end.

• A quote template containing the full customer list.

• A message thread with a municipal project manager referencing a job starting in three weeks with a hard deadline the company cannot afford to miss.

The ransom is set at $65,000 in cryptocurrency. Ransoms above 10 percent of visible liquid assets tend to get contested. This figure sits comfortably below that line, high enough to be worth the effort, and low enough that paying becomes more practical than fighting it.

The encryption payload deploys at 2:47 p.m. on Friday. The timing isn't accidental. The office manager leaves at 3 p.m., and the owner's shared calendar confirms they're on a job site. By Friday evening, every file on the shared drive is encrypted, and a ransom note sits on every screen in the office.

Total attacker cost: $14 in credentials and roughly six hours of work across the week.

Five Points Where This Attack Would Have Stopped

The encouraging part of this story is that none of these steps require a complete technology overhaul. In many cases, they're simply security features that are already included with the tools your business uses today. The key is making sure they're configured properly and actively managed.

1. Stop Stolen Passwords from Being Used

The attack only moved forward because the attacker found a password that still worked. Modern security tools can identify passwords that have been exposed in previous data breaches and prevent people from using them. Combined with a password manager that creates a different password for every account, that $14 credential purchase becomes worthless.

It's also worth checking whether any of your company email addresses have appeared in known data breaches. Free services like Have I Been Pwned make that easy.

2. Strengthen Your MFA

Multi-factor authentication is one of the best ways to protect your accounts, but not every type of MFA offers the same level of protection. Some newer sign-in methods are specifically designed to stop the kinds of phishing attacks used in this example, making it much harder for an attacker to log in as one of your employees, even if they have a stolen password.

Pair that with settings that only allow logins from trusted devices and tools that block phishing emails before they ever reach your employees, and this attack likely would have ended on Thursday instead of Friday.

3. Stop Attackers from Quietly Watching Your Email

One of the most important parts of this attack happened before the ransomware was ever deployed. The attacker secretly set up an automatic email forwarding rule that sent every incoming message to an external inbox. That gave them time to learn how the business operates and determine how much ransom to demand.

Most Microsoft 365 environments can be configured to block this type of automatic forwarding altogether. If that setting had been enabled, the attacker would have lost the information they needed to plan the rest of the attack.

4. Pay Attention to the Warnings You Already Receive

Many businesses already have security tools that generate alerts when suspicious activity happens. The problem isn't always that the alerts don't exist. It's that no one is reviewing them.

In this example, creating the email forwarding rule would have generated an alert. Catching it that night could have stopped the attack before any files were encrypted. Sometimes the biggest improvement isn't buying another security tool. It's making better use of the ones you already have.

5. Be Thoughtful About What You Share Publicly

Attackers don't always start with sophisticated hacking. Often, they begin with information anyone can find online.

The office manager's LinkedIn profile clearly described her financial responsibilities, making her an obvious person to target. Public business records aren't going away, but it's worth helping your team understand how small details shared online can make your business easier to profile.

Three Questions to Ask Your IT Provider

You don't need to know how to configure any of these protections yourself. That's your IT provider's job. But you should know whether they're in place.

Start by asking these three questions:

1. Are we using the strongest multi-factor authentication (MFA) available for employees with access to financial systems, sensitive information, or administrative accounts?

2. Have we blocked automatic email forwarding outside the company unless there's a legitimate business reason for it?

3. Are security alerts being reviewed regularly, and who is responsible for responding when something looks suspicious?

If the answers aren't clear, that's exactly where to start. Those questions aren't meant to catch anyone off guard. They're meant to help you understand whether your current protections are working the way you expect them to.

Every business owner deserves the confidence of knowing their business is protected. If you're not sure where your business stands today, click here to schedule a quick 26-minute call. We'll help you identify potential gaps, answer your questions, and give you a practical plan for strengthening your security.

Article FAQs

Do ransomware attackers actually target small businesses?

Yes. Most ransomware operations focus on small and mid-sized businesses because the ratio of potential payout to defensive resources is favorable at that size. Companies between 10 and 50 employees typically carry enough revenue and data to make encryption costly, but don't have a dedicated security team to prevent or respond to an attack. That combination is precisely what makes them attractive targets.

What is adversary-in-the-middle phishing, and why does it bypass MFA?

Adversary-in-the-middle phishing works by placing an attacker-controlled proxy page between the user and the real login screen. When the user enters their credentials and completes the MFA prompt, the proxy forwards both to the legitimate server and captures the resulting session token. The authentication technically succeeds, but the active session ends up in the attacker's browser rather than the user's. This technique has become the dominant credential-based attack method against Microsoft 365 accounts since the default rollout of number matching closed the simpler push-bombing approach.