How Small Business Ransomware Attacks Work and How to Stop Them

Small businesses are one of the most common ransomware targets. Many owners assume cybercriminals focus on large enterprises, but attackers often prefer smaller organizations because they offer valuable data, limited security resources, and a higher chance of payment.

A 22-person business can be researched in under an hour, compromised through a single phishing click, and locked out of its systems within days. The good news is that the attack chain is predictable, which means it can be stopped with the right cybersecurity controls. In many cases, those protections are already included in the managed IT and cloud security tools businesses use today.

How the attack starts

Attackers usually begin by looking for businesses that appear profitable enough to pay but small enough to defend poorly. Public business records, LinkedIn profiles, company websites, and social media posts provide enough information to identify key employees, common software, and likely payment workflows.

From there, the attacker builds a target profile. They learn who handles payroll, who approves invoices, and which accounts are most likely to have elevated access. That research costs little and often takes less than an hour.

How credentials are stolen

The next step is often stolen credentials. Attackers buy login details from “stealer logs,” which are collections of usernames, passwords, cookies, and tokens taken from infected personal devices. These records are frequently sold on underground marketplaces for a small amount of money.

Once a valid password is found, the attacker checks whether it still works. If the employee reuses passwords across accounts, the risk becomes even higher. A compromised personal account can lead directly to a business email account or cloud platform.

How MFA gets bypassed

Multi-factor authentication helps, but not all MFA is equal. Traditional push-based MFA can be defeated through phishing tactics that capture both the password and the session token.

A more advanced attack uses a fake login page that mirrors Microsoft 365 or another cloud platform. When the user enters credentials and completes MFA, the attacker captures the session token and logs in as that user. To the service, the login looks legitimate.

This is why phishing-resistant MFA matters. Passkeys, FIDO2 security keys, and Windows Hello for Business offer much stronger protection than basic approval prompts.

Why attackers wait before encrypting

After gaining access, many attackers do not encrypt files immediately. They spend time reading inboxes, reviewing attachments, and learning how much the business can pay.

That waiting period helps them identify cyber insurance limits, bank balances, customer lists, and project deadlines. With that information, they set a ransom amount designed to pressure the business into paying quickly.

Then they launch the ransomware at the worst possible time, often late on a Friday when staff are unavailable and response time is delayed.

Five controls that stop the attack

The best part of this attack chain is that it can be broken in several places. These controls are practical, affordable, and often already included in existing security subscriptions.

1. Block reused and compromised passwords

Use password protection policies to block common and previously breached passwords. A password manager and unique passwords for every account reduce the value of stolen credentials.

2. Upgrade MFA to phishing-resistant methods

Replace simple push-based approval with passkeys, FIDO2 keys, or Windows Hello for Business. Pair this with Conditional Access policies that require trusted or compliant devices.

3. Block external email forwarding rules

Attackers often create hidden inbox rules to monitor email quietly. Microsoft 365 can block external forwarding at the tenant level, which helps prevent long-term access and data theft.

4. Monitor security alerts actively

Many small businesses already receive alerts from Microsoft Defender for Business or similar tools, but nobody reviews them. Make sure alerts are routed to someone who can act on suspicious activity quickly.

5. Reduce public exposure

Attackers use public records and employee profiles to choose targets. Limit unnecessary detail on websites, job posts, and social profiles, especially information about finance, approvals, and internal software.

Questions to ask your IT provider

If you work with a managed IT provider, ask these questions:

• Are we using phishing-resistant MFA for sensitive accounts?

• Is external email forwarding blocked?

• Are security alerts being monitored and reviewed?

• Are passwords protected against known-compromised credentials?

• Are our cloud accounts configured to reduce token theft and account abuse?

These questions help identify gaps without requiring a major technology overhaul.

Final thoughts

Small business ransomware is not random. It follows a repeatable pattern that uses public information, weak passwords, credential theft, and delayed response. The attack becomes far less effective when businesses use the security controls they already have access to.

A strong cybersecurity strategy, supported by managed IT services and cloud security best practices, can stop ransomware before it spreads. The key is making sure the right protections are turned on, reviewed regularly, and tied to real business risk.

If you need help strengthening your ransomware defenses,Hoop5 can assess your environment and help you build a more secure, resilient IT foundation.

For more tips and tech info, follow us on LinkedIn and Instagram. 

Inspired by insights from The Technology Press.