Ransomware attacks have shifted decisively toward small and mid-sized businesses (SMBs). While headline-grabbing attacks against Colonial Pipeline and MGM Resorts dominate the news cycle, the reality is that organizations with 100–1,000 employees now account for the majority of ransomware incidents. The reason is simple: SMBs often lack dedicated security teams but hold valuable data and have enough revenue to pay ransoms.
The average ransom payment exceeded $1.5 million in 2024, and the total cost of recovery — including downtime, lost business, and remediation — typically runs 5–10x the ransom itself. For many SMBs, a successful ransomware attack is an existential event.
The Modern Ransomware Playbook
Today's ransomware operations bear little resemblance to the spray-and-pray campaigns of a few years ago. Modern groups like LockBit, BlackCat/ALPHV, and Cl0p operate as professional organizations with customer support, affiliate programs, and dedicated negotiators.
Double and Triple Extortion
Encryption alone is no longer the primary leverage. Attackers now routinely exfiltrate sensitive data before deploying encryption, threatening to publish it if the ransom isn't paid. Some groups have added a third layer: DDoS attacks against the victim's public-facing services to increase pressure during negotiations.
Dwell Time
The average attacker resides in a victim's network for 5–10 days before deploying ransomware. During this time, they map the network, identify and disable backups, escalate privileges, and exfiltrate data. This dwell time is both a vulnerability and an opportunity — it's a window where detection and response can prevent the final payload.
Prevention: Shrinking the Attack Surface
Patch Management
Unpatched vulnerabilities remain the #1 initial access vector for ransomware. Establish a patch management program that addresses critical vulnerabilities within 72 hours and high-severity vulnerabilities within two weeks. Pay particular attention to:
- VPN appliances and remote access gateways
- Email servers (Exchange, Zimbra)
- File transfer applications (MOVEit, GoAnywhere)
- Hypervisors (VMware ESXi)
Email Security
Phishing remains the second most common initial access vector. Deploy email security solutions that go beyond basic spam filtering:
- Attachment sandboxing to detonate suspicious files in isolated environments
- URL rewriting and time-of-click analysis
- DMARC, DKIM, and SPF to prevent domain spoofing
- User awareness training with simulated phishing campaigns
Access Controls
- Enforce MFA on all remote access, email, and administrative interfaces
- Implement privileged access management (PAM) for administrative accounts
- Disable RDP on internet-facing systems — or at minimum, require VPN + MFA
- Remove local administrator rights from standard user accounts
Detection: Catching Attacks in Progress
Endpoint Detection and Response (EDR)
Traditional antivirus is insufficient against modern ransomware. EDR solutions provide behavioral detection that can identify ransomware activity — mass file encryption, shadow copy deletion, credential dumping — even when the specific malware variant is unknown.
Network Monitoring
Monitor for indicators of lateral movement:
- Unusual SMB traffic patterns between workstations
- PowerShell remoting and WMI execution across systems
- Kerberoasting and other Active Directory attack techniques
- Unexpected outbound data transfers (exfiltration)
Log Aggregation
Centralize logs from endpoints, network devices, and cloud services into a SIEM or log management platform. Key events to alert on include:
- Backup service or shadow copy modifications
- Security tool tampering or disabling
- New service installations across multiple hosts
- Abnormal authentication patterns
Recovery: Planning for the Worst
The 3-2-1-1 Backup Strategy
The traditional 3-2-1 rule (three copies, two media types, one offsite) needs an update for the ransomware era. Add a fourth element: one immutable copy.
- Immutable backups cannot be modified or deleted for a defined retention period, even by administrators. This prevents attackers who have compromised admin credentials from destroying backups.
- Air-gapped backups — physically disconnected storage — provide the highest level of protection but require more operational overhead.
- Test your restores regularly. A backup you haven't tested is a backup you can't trust. Conduct quarterly restore drills for critical systems.
Incident Response Plan
Document and rehearse your response to a ransomware incident:
- Containment: Immediately isolate affected systems. Disable network shares. Block lateral movement by segmenting the network.
- Assessment: Determine the scope of encryption and data exfiltration. Identify the ransomware variant and check for available decryptors.
- Communication: Notify leadership, legal counsel, and your cyber insurance carrier. Determine regulatory notification obligations (GDPR 72-hour rule, state breach notification laws).
- Recovery: Begin restoring from clean backups, starting with critical business systems. Rebuild compromised Active Directory infrastructure from scratch.
- Post-Incident: Conduct a thorough root cause analysis. Remediate the initial access vector. Update detection rules and security controls.
Cyber Insurance
Cyber insurance is not a substitute for security controls, but it provides critical financial protection. When evaluating policies:
- Ensure coverage explicitly includes ransomware events, including ransom payments if your organization's policy permits payment
- Understand the policy's sublimits for business interruption, data recovery, and notification costs
- Be honest on the application — misrepresentations can void coverage when you need it most
- Review the insurer's pre-approved incident response vendors and ensure they align with your expectations
The "To Pay or Not to Pay" Question
This is ultimately a business decision that must be made with legal counsel, insurance carriers, and potentially law enforcement. However, consider:
- Payment does not guarantee data recovery. Approximately 20% of organizations that pay never receive a working decryptor.
- Payment funds further criminal activity and marks your organization as a willing payer.
- Some jurisdictions restrict or prohibit ransom payments, particularly to sanctioned entities.
- If you have tested, immutable backups and a practiced recovery plan, payment becomes unnecessary.
Building a Resilience Program
True ransomware resilience is not a single technology or policy — it's a program that spans prevention, detection, and recovery. Start with the basics: patch your systems, enforce MFA, deploy EDR, and implement immutable backups. Build from there with network monitoring, incident response planning, and regular testing.
The goal is not to make a ransomware attack impossible — it's to make recovery fast, reliable, and far less costly than paying a ransom.