The ransomware story that most small and mid-sized businesses have in their heads is four years out of date. It features a spray of malicious emails, a few hundred dollars demanded, an encrypted laptop, and a decision about whether to pay. That version has largely been retired by the people running these operations, because it was not profitable enough. What has replaced it is patient, targeted and considerably more expensive. Operators gain access, often weeks before anything visible happens, escalate privileges, map the network, identify and destroy the backups, and only then encrypt, choosing a moment that maximises pressure. The demand is sized to the victim rather than fixed. The SMB ransomware epidemic of 2019 is not a volume problem; it is a change in business model, and the target profile has shifted decisively towards organisations with enough money to pay and not enough security to resist.
Why smaller organisations became the preferred target
Large enterprises got harder. Not uniformly, but enough that the return on effort declined: endpoint detection, segmented networks, tested backups, dedicated response teams and the ability to absorb a week of disruption without existential consequences. Mid-sized businesses have the worst combination of characteristics available. They depend entirely on their systems, they have real revenue, they carry no dedicated security staff, their backups are usually attached to the network they are meant to protect, and their tolerance for downtime is measured in days rather than weeks. A manufacturer that cannot ship, a clinic that cannot access records, a logistics firm that cannot produce paperwork, all reach the same conclusion within about seventy-two hours. And the public sector variant of the same profile is currently demonstrating this in real time. American municipalities have been hit repeatedly this spring, most visibly Baltimore, whose systems were encrypted earlier this month and which has refused to pay a demand in the region of thirteen bitcoin while recovery costs run into the millions. Two Florida cities have taken the opposite route and paid six-figure sums. Neither choice looks good, which is the point of the business model.
The entry routes are boring and well documented
Exposed remote desktop is the leading one. Every internet-facing remote desktop service with a weak or reused password is a credential-stuffing target, and lists of exposed hosts are traded openly. Email-borne loaders are the second. The pattern now runs through commodity banking malware that establishes persistence, sells or hands off access, and ends in a targeted encryption event weeks later. An infection that antivirus cleaned up in March can be the reason the network goes down in May. The third route is the one that should worry every smaller business that outsources its IT: the managed service provider. Compromise the provider's remote management and monitoring tooling and you inherit privileged access to every client simultaneously. Several incidents this year have followed exactly this path, and it turns a supplier relationship into a shared fate. Unpatched perimeter services complete the list. Nothing exotic appears on it.
Backups are the whole game, and most fail the only test that matters
The modern attack assumes you have backups and sets out to destroy them first. Network-attached storage reachable with the same credentials as everything else, backup servers joined to the same domain, and cloud sync folders that dutifully replicate encrypted files are all standard findings. The test is not whether backups exist. It is whether a copy exists that an attacker holding domain administrator rights cannot delete, and whether anyone has ever restored the whole environment from it under time pressure. Organisations that have done that exercise negotiate from a position of strength. Organisations that have not are, in effect, uninsured.
Practical Guidance for SMB Ransomware Protection
- Take remote desktop off the public internet. Put it behind a VPN with multi-factor authentication, or remove it. This single change eliminates the most common entry route.
- Keep one backup copy offline or immutable. Different credentials, not domain-joined, and out of reach of any administrator account on the production network.
- Restore something every quarter. A full system, timed, with the people who would actually do it. Untested backups fail at roughly the rate you would fear.
- Turn on multi-factor authentication for email and remote access now. It is free or nearly free in most productivity suites and it blocks the credential attacks that begin most incidents.
- Interrogate your IT provider's own security. How they authenticate to your systems, whether their management tooling requires a second factor, how quickly they would tell you if they were breached. Put the answers in the contract.
- Separate administrator accounts from daily accounts. Most lateral movement depends on one person browsing email as a privileged user.
- Write the decision framework before you need it. Who authorises payment, who talks to staff and customers, which lawyer and which responder you call. Deciding this during an incident costs days.
- Check your insurance wording. Whether ransom payment is covered, whether business interruption is included, what the notification requirement is, and what conditions could void it.
The Regional Angle
Gulf organisations carry a particular exposure that has nothing to do with the state-sponsored wiper attacks the region is better known for. The mid-market here runs lean on internal technology staff and leans heavily on a small number of local IT support companies, each serving dozens or hundreds of clients through the same remote management tooling. That concentration is efficient and it is also the single largest systemic risk in the regional SMB technology estate. Any business that has outsourced its infrastructure to a local provider should treat that provider's security posture as its own, and should ask the uncomfortable questions in writing. There is a second structural weakness in how regional businesses buy infrastructure. A great deal of it was sold as an appliance: a server in a cupboard, a backup box beside it, a firewall configured at installation and never revisited, with support arranged reactively rather than through a maintenance contract. Firmware on those devices is frequently years behind, and in family businesses the person who knew the setup has often left the country. Patching is not neglected out of indifference so much as because nobody owns it. Payment raises questions here that are easy to get wrong. Cryptocurrency access and transfer sit in an uncertain and evolving regulatory space across the Gulf, and a company deciding under pressure to pay a ransom may be making a financial-crime and sanctions decision as well as a commercial one. That analysis needs a lawyer, and it needs to have started before the incident. The reporting picture is also uneven. Incident notification expectations vary by jurisdiction and by sector, with regulated financial institutions and healthcare providers facing far clearer obligations than a mainland trading company, and there is a strong cultural preference for handling these matters quietly to protect reputation and commercial relationships. That silence has a cost: regional businesses have very little shared intelligence about what is actually hitting companies down the street. The national cybersecurity bodies across the Gulf publish advisories, and small organisations should be reading them, because they are the closest thing to a local early warning system. Finally, the calendar. Attackers reliably choose weekends, and in this region the working week, the long Eid holidays and the summer exodus create predictable multi-day windows where an encryption event runs unnoticed for far longer than it would in Europe. Monitoring coverage over those periods is worth more here than the headcount suggests.
The objection worth taking seriously
The objection from a two-hundred-person business is reasonable: this is an enterprise security programme described in smaller words. There is no security team, no budget line, no capacity to run quarterly restore drills, and the list above competes with things that generate revenue. Telling a company with three IT staff to implement segmentation, privileged access management and continuous monitoring is advice that will be nodded at and not acted on. The harder version questions the value of the spending at all. Ransomware is a crime problem, not an IT problem, and the defensive arms race is one the defender loses on economics. Meanwhile the existence of insurance and of professional negotiators has arguably made the market worse: it has established that mid-sized victims will pay, it has standardised the pricing, and each payment funds the next campaign. An individual business acting rationally, paying because paying is cheaper than rebuilding, contributes to an outcome that is worse for everyone including itself. That is a genuine collective action problem and no single company can solve it. What a single company can do is make itself a bad target and remove the leverage. The four controls that matter, removing exposed remote access, enabling multi-factor authentication, holding one backup copy the attacker cannot reach, and testing a restore, are not an enterprise programme. They cost very little, they can be completed in a month, and together they defeat the great majority of what is actually happening. The sophisticated remainder is real, but it is not what is encrypting mid-market businesses this spring. Do the four things, then argue about the rest.
Common Questions
Should we pay?
It is a commercial decision made under duress, and it should be made against a framework written in advance. Payment does not guarantee a working decryption tool, does not prevent stolen data being used later, may carry sanctions exposure depending on who is behind the attack, and marks you as a payer. Organisations with a tested offline backup rarely need to consider it.
Is antivirus enough?
No. Signature-based detection routinely misses tooling that is built from legitimate administrative utilities. Modern endpoint detection with behavioural monitoring is meaningfully better and is now affordable at small scale, but it does not substitute for closing the entry routes.
How long are attackers inside before encryption?
Commonly weeks. The encryption is the last step, not the first. That gap is why monitoring and alerting on unusual administrative activity pays for itself, and why an incident is rarely as sudden as it feels.
What should we expect over the next twelve months?
Expect demands to keep rising as operators get better at sizing them to the victim's finances. Expect more attacks routed through managed service providers, because the economics of compromising one supplier to reach a hundred customers are unbeatable. Expect the public sector wave now running through American municipalities to continue and to draw legislative attention to whether paying should be permitted. And expect insurers to tighten conditions and raise premiums as claims accumulate, which will make basic controls a condition of cover rather than a recommendation.
SMB Ransomware Protection — we close the four doors that account for most incidents, prove your backups restore under pressure, and put your IT provider's security in writing before it becomes your problem.