Small businesses are the most common ransomware target by volume of incidents — even though many owners assume hackers focus on larger organizations.
A 22-person company has enough revenue to be worth attacking, no dedicated security team to defend it, and a publicly traceable footprint that takes about an hour to research. That profile fits a lot of commercial services, professional firms, and contractors across Laurel, Hattiesburg, Meridian, and the rest of the Pine Belt.
What follows is a step-by-step walkthrough of how a small business gets attacked, written from the attacker’s side. The company is composite; the methods match current threat intelligence. After the walkthrough, you’ll see five specific points where the attack would have died — usually with controls already bundled into security tools most small businesses already pay for.
Monday: how I picked you
I work regular hours and run a small-volume operation. My spreadsheet has about 40 prospects per month. I prefer businesses between 10 and 50 staff.
Large enterprises have security teams, incident response contracts, and lawyers who make recovery expensive on my end. Sole proprietors rarely have enough at stake. A mid-sized services company sits in the right zone: payroll, customer database, project files, supplier relationships, and an owner who will pay to get operations back.
I did not find you through a breach tip. I found you on a public business records portal. State registries, federal contract awards, and county licensing databases publish enough detail to identify your company, estimate revenue, and pick the most useful person inside the business.
The fact that nothing has gone wrong yet is a strong signal: credentials are probably still valid, staff haven’t been trained to spot this pattern, and nobody has had a reason to change a password.
Tuesday: building your org chart for free
I spend about 40 minutes researching your company using only a browser.
LinkedIn gives me current employees and titles. Your office manager lists accounts payable, payroll, and supplier invoicing. Public filings confirm legal names. An old “meet the team” social post lists first names and photos. Job ads mention QuickBooks or similar — so I know what software to expect.
I now know who handles money, how long they’ve been there, and who can approve a payment without a second signature. That last person is my primary target: system access, supplier payments, and a busy enough inbox that one more email may not get the scrutiny it deserves.
I have not spent a dollar yet.
Wednesday: I bought your credentials for $14
Stealer logs are credential packages harvested by infostealer malware — often from a personal device months or years earlier. Marketplaces let buyers search by company email domain.
I search your domain. Two results: the office manager’s work email with a browser-saved password, and a related personal account. I pay $14. It takes four minutes.
The work password follows a common pattern and appears in an older public breach dump. It hasn’t been changed. Variations of a family password also show up across personal services — and against your Microsoft 365 login. The password works. The only thing standing between me and the inbox is the second factor.
Total spend so far: $14.
Thursday: getting past your MFA
Multi-factor authentication stops a lot of attacks — but the implementation matters more than the checkbox.
Simple push-notification fatigue often fails now that Microsoft Authenticator uses number matching by default. What still works is adversary-in-the-middle (AiTM) phishing.
I send a fake Microsoft 365 password-reset email that cites the breach her password appeared in. The link opens a page that mirrors the real sign-in screen — a proxy I control. When she enters her password and completes MFA, my proxy forwards both to Microsoft. Microsoft issues a session token to my proxy. I capture it. She sees a normal “password updated” message.
I am now signed in as her. Microsoft sees a valid session and treats my activity as legitimate.
Backup plan: a phone call posing as IT support, using a name from an old Google review, asking staff to approve a verification push. If the email doesn’t get clicked, social engineering is plan B.
By Thursday night I’m inside the Microsoft 365 account. I set an inbox forwarding rule so her email copies to an address I control — without notifying her — then I wait.
Friday 2:47 p.m.: why I waited 36 hours before encrypting
I spend 36 hours reading email before I encrypt anything. That dwell time is how I size the ransom correctly.
In those hours I find a cyber insurance attachment with a cyber liability sub-limit, a bank reconciliation with month-end cash, a customer list in a quote template, and a project thread with a hard deadline you can’t afford to miss.
I set the ransom in a range low enough that you’ll pay rather than fight, high enough to be worth my time, and within what liquid assets suggest you can access.
I deploy encryption late Friday afternoon on purpose. The person most likely to notice is already gone for the weekend. The person with authority to decide is hard to reach. By the time anyone understands what happened, shared files are encrypted and a ransom note sits on every screen.
Total cost to the attacker: about $14 and six hours of work across the week.
Five places this attack would have died
None of these controls were exotic. Most were already available in tools many small businesses already license.
1. The credential purchase on Wednesday
Have I Been Pwned is free. Microsoft Entra password protection can block reused or commonly compromised passwords. Enforcing unique passwords through a password manager and Entra policies makes a $14 stealer-log purchase far less useful.
2. The MFA bypass on Thursday
Number matching blocked simple push bombing. AiTM phishing is the current dominant credential-based bypass. Defenses include phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business), Conditional Access that requires a compliant or hybrid-joined device, and anti-phishing protection in Microsoft Defender for Office 365. Any one of these can stop token theft — or make a stolen token useless from the attacker’s network.
3. The inbox forwarding rule
Microsoft 365 admins can block external email forwarding at the tenant level. With that block in place, the forwarding rule used to read 36 hours of email fails. The attacker might still encrypt — but they’d be guessing on ransom size.
4. The 36-hour dwell time
Microsoft Defender for Business (included with Microsoft 365 Business Premium) can alert when a new inbox forwarding rule is created. If those alerts go somewhere visible — or into a managed SOC — the intrusion can be caught Thursday night. For many Pine Belt businesses, the biggest win isn’t a new product; it’s someone reviewing the alerts tools you already pay for are already generating.
5. Public business records
You can’t unpublish a state registry or contract award. You can coach staff on how much financial responsibility detail they put on LinkedIn. Frame it as practical awareness, not a social-media ban.
At West Computers we enforce phishing-resistant sign-ins and Conditional Access across managed Microsoft 365 tenants, block risky forwarding patterns, and watch alerts through 24/7 MXDR — so dwell time doesn’t quietly become a Friday encryption event.
Three questions to send your IT provider
- Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and executive logins?
- Is external email forwarding blocked at the tenant level?
- Are our security alerts going somewhere — and is someone reviewing them?
Frequently asked questions
Do hackers target small businesses?
Yes. Most ransomware operations favor small and mid-sized businesses because the ratio of payout potential to defensive resources is higher than at either extreme. The volume sweet spot is roughly 10 to 50 staff.
What is adversary-in-the-middle (AiTM) phishing?
The attacker hosts a proxy that mirrors a real login screen (for example Microsoft 365). When the user enters credentials and completes MFA, the proxy captures the session token. The legitimate service treats the login as successful — but the token ends up in the attacker’s browser. AiTM became dominant against Microsoft 365 after number matching reduced simpler push-bombing attacks.
What is a stealer log?
A package of credentials harvested by infostealer malware from an infected personal device — often including browser-saved passwords, cookies, and tokens — sold on underground markets, frequently for $10–$20 per package.
How much does it cost an attacker to compromise a small business?
In this walkthrough, about $14 plus roughly six hours of work. Thresholds vary, but attempting this pattern often sits well below $100 in direct cost.
Are there free or already-paid tools that would have stopped this?
Several controls come bundled with Microsoft 365 Business Premium: external forwarding restrictions and Defender for Business alerts are configuration changes, not always new purchases. Have I Been Pwned is free. Phishing-resistant MFA hardware keys are a small per-user cost compared with a successful ransomware incident.
Article adapted with permission from The Technology Press.