Cybersecurity in the SMB space — a growing threat

Small and medium-sized businesses (SMBs) are increasingly targeted by cybercriminals. Despite adopting digital technology for remote work, production, and sales, SMBs often lack robust cybersecurity measures.

SMBs face significant cybersecurity challenges due to limited resources and expertise. The cost of data breaches can cripple operations, making preventive measures essential. This is a growing tendency that continues to pose a challenge for businesses. For example, the UK’s National Cyber Security Centre reports that around 50% of SMBs in the UK are likely to experience a cybersecurity breach annually. Addressing cybersecurity requires a multifaceted approach, combining technological solutions with fostering a security-aware culture within the organization.

A rising tide of cyberthreats

Kaspersky presents the findings of its 2024 threat analysis for the SMB space, including real-world examples of attacks.

To get information on the threats facing the SMB sector, Kaspersky analysts cross-referenced selected applications used in the SMB space against Kaspersky Security Network (KSN) telemetry to determine the prevalence of malicious files and unwanted software targeting these programs, as well as the number of users attacked by these files. KSN is a system for processing anonymized cyberthreat-related data shared voluntarily by opted-in Kaspersky users. We included the following programs in our research:

• Microsoft Excel;
• Microsoft Outlook;
• Microsoft PowerPoint;
• Salesforce;
• Microsoft Word;
• Microsoft Teams;
• QuickBooks;
• Microsoft Exchange;
• Skype for business;
• ClickUp;
• Hootsuite;
• ZenDesk.

Percentage of unique files with names that mimic the top 9 legitimate applications, 2023 and 2024 (download)

Percentage of unique users targeted through the top 9 investigated applications, January 1 – April 30, 2024 (download)

As the graphs above show, for the period from January 1, 2024 to April 30, 2024, the total number of users who encountered malware and unwanted software hiding in or mimicking investigated software products for SMBs was 2,402, with 4,110 unique files distributed under the guise of SMB-related software. It shows an 8% increase as compared to the 2023 findings, which points at an ongoing rise of attacker activity.

The most notable development of unique files with names that mimic legitimate software used to deliver an attack saw Microsoft Excel move up the threat list from fourth to first place between 2023 and 2024. Microsoft Excel has been leveraged by cybercriminals for many years.

Top threat types that affected the SMB sector, 2023 vs 2024 (download)

The data finds that the overall number of infections in the SMB sector from January 1, 2024 to April 30, 2024, rose to 138,046 against 131,219 in the same period in 2023 – an increase of over 5%.

Trojan attacks remain the most common cyberthreat, which indicates that attackers continue to target SMBs and favor malware over unwanted software. Trojans are particularly dangerous because they mimic legitimate software, which makes them harder to detect and prevent. Their versatility and ability to bypass traditional security measures make them a prevalent and effective tool for cyberattackers. However, the biggest change year-on-year stems from DangerousObject attacks. This is malicious software detected by Kaspersky Cloud Technologies. DangerousObject-class verdicts are a collective of various previously undetected samples. The broad and unspecific nature of this category underscores the complexity and evolving nature of cyberthreats, making it a significant concern for cybersecurity efforts.

Phishing

Employee negligence remains a significant vulnerability for SMBs. Human error, often stemming from a lack of cybersecurity awareness, can lead to severe security breaches. Falling for phishing schemes can have catastrophic consequences for businesses.

Phishing attacks are distributed via various channels, including spoofed emails and social media, to fool users into divulging login details or other sensitive data. Attacks like these can be targeted at SMBs, which poses a threat for growing loyalty and securing infrastructures. Our research provides a deeper look at the current climate with a breakdown of examples.

Phishing websites can imitate popular services, corporate portals, online banking platforms, etc. Targets are encouraged to sign in, whereby they inadvertently divulge usernames and passwords to the cybercriminals, or trigger other automated cyberattacks. Or both.

Below is a spoofed site that replicates the login page of a legitimate delivery service that employees use on a regular basis. Harvesting login credentials enables cybercriminals to redirect orders and/or immediately cancel services, and have money refunded and redirected to a new account. A scheme like this can easily go unnoticed over a long period of time without appropriate enterprise cybersecurity mechanisms in place.

In the following example, attackers have spoofed the customer login page of a company that specializes in small business insurance. Armed with this information, the cybercriminals gained access to clients’ accounts, leading to further infiltration and potential theft of sensitive enterprise data.

In recent years, we’ve been observing a trend of spreading web pages that mimic the most commonly used Microsoft services (Microsoft 365, Outlook, OneDrive, etc.). This tendency, aimed at business users, arises from the widely popular business approach of using a software package for all business purposes, which makes its users more dependent on particular applications and services and thus more susceptible to this attack vector.

Email

Email remains one of the most widely used channels for phishing. In the example below, attackers passed themselves off as representatives of a legal entity that needs to sign an agreement with the target organization. The attackers generally use email addresses that are very similar to those used by legitimate companies. Here they used a phishing form that mimics a common enterprise service template.

Social media

Cybercriminals can hack or spoof a business’s social media accounts. Doing this enables them to post harmful content, spread false information, and carry out phishing schemes, damaging the business’s reputation and trustworthiness.

A hack like this can result in a loss of followers and customers, which in turn harms sales and revenue. Furthermore, the attackers could use the compromised account to deceive customers into giving away sensitive information, further eroding trust and potentially exposing the business to legal issues.

Imitating and abusing large social media platforms can not only disrupt business operations and cause financial losses, but also result in data leaks and major security breaches. In some cases, attackers use legitimate Facebook infrastructure to compromise corporate social media accounts. We have also found numerous cases of attackers mimicking genuine social media login pages. The following example is related to TikTok Shop, an e-commerce feature of TikTok allowing businesses to sell their products.

Spam

We have discovered multiple cases of SMB-oriented spam. Spammers target organizations with what seems like an appealing credit deal or a large one-off discount. The scope of available services is usually typical for SMB needs — tailored branding solutions, advertising products, financial support — although generally such companies are considered unreliable. In the example below, spammers offered a client database for research and marketing purposes.

Best practices for asset protection

By investing in end-to-end cybersecurity solutions and promoting vigilance, SMBs can mitigate risks and ensure business continuity. It is no less vital that SMBs educate employees about cyberthreats in addition to implementing robust security measures, such as spam filters, email authentication protocols, and strict verification procedures for financial transactions and sensitive information sharing.

Essential steps toward cyber resilience include recognizing the importance of comprehensive security protocols and periodical updates. Regular security awareness trainings, strong password policies, and multifactor authentication can also help mitigate the risks associated with phishing and scam threats.

Cyberprotection action plan for SMBs

1. Establish a policy governing access to corporate resources, including email accounts, shared folders, and online documents. Maintain strict control over the number of users who can access critical corporate data, ensure this access list is up to date and revoke permissions when an employee leaves the company. Use cloud access security broker software to manage and monitor employee activities within cloud services and enforce security policies.
2. Back up essential data regularly so that corporate information stays safe and can be recovered in case of emergency.
3. Offer transparent guidelines for using external services and resources. Design clear procedures of approval with IT and other responsible roles for specific tasks, such as new software adoption. Include basic cybersecurity rules in succinct staff policies, paying extra attention to safe account and password management, email security, and web browsing. Implement a comprehensive training program to equip employees with the necessary knowledge and practical skills.
4. Deploy specialized cybersecurity solutions that provide visibility over cloud services, such as Kaspersky Next.