Ransomware Is Now a Franchise Business, and Small Companies Are the Preferred Customer

Ransomware — malicious software that locks up an organisation's files and demands payment to unlock them — used to require the attacker to be technically capable. That barrier is largely gone. The dominant model now is ransomware-as-a-service: skilled criminal groups build the tools, run the payment and negotiation infrastructure, and rent the whole package to less-skilled affiliates who carry out the attacks and split the proceeds. It mirrors the legitimate software industry almost exactly — a platform, a subscription, customer support, a revenue share — and it has the same effect the software-as-a-service model had on business: it lets people who could never have built the product themselves use it at scale. The consequence for who gets attacked is the important part. When attacks required skill, criminals concentrated on large targets worth the effort. When attacks become a rented commodity, the economics invert: it costs an affiliate almost nothing to hit a small target, so small targets become worth hitting in volume. Small and mid-sized businesses, which long assumed they were too minor to attract a serious attacker, have become a preferred market precisely because they are numerous, they tend to have weaker defences, they often lack the backups that would let them refuse to pay, and they are more likely to quietly pay a modest ransom to get running again. The assumption "we are too small to be a target" is now not just wrong but backwards. What makes this survivable is that the attacks rented out at volume mostly rely on unglamorous, well-understood weaknesses, which means unglamorous, well-understood defences blunt most of them. The common entry points are a stolen or guessed password on a remote-access system, a person tricked into opening a malicious attachment, and an unpatched piece of software with a known hole. None of the defences against these are exotic. Multi-factor authentication on every remote login defeats a stolen password. Keeping systems patched closes the known holes the rented tools rely on. Training people to recognise the phishing email removes the most common trigger. And the single most powerful measure is boring: reliable, tested, offline backups, because a business that can restore its own data can refuse to pay. For a small business the mindset shift is to stop treating ransomware as a threat aimed at someone bigger and start treating it as a volume crime that will eventually point automated tooling at anyone reachable. The good news buried in that is that because the attacks are commoditised and unsophisticated, the defences do not have to be sophisticated either — they have to be present. Multi-factor authentication, current patches, trained staff, and above all backups that are kept offline and actually tested by restoring from them, put a business out of reach of the vast majority of these rented attacks. The criminals have industrialised; the defence is to do the basics reliably, which most victims were not doing.