Ransomware-as-a-Service: Why Any Small Business Is Now an Easy Target

The owner of a 22-employee auto parts distributor in Cali had a comforting theory: "nobody's targeting us, we're too small to be worth the effort." Six months later, his entire inventory and billing database was encrypted, with a note demanding cryptocurrency payment to restore access. The attacker had never heard of his company specifically. It didn't need to — a program had scanned thousands of networks looking for the easiest one to break into, and it wasn't a person who chose to attack him.

That's the logic behind ransomware-as-a-service, and it's exactly why "we're too small to be targeted" stopped being a valid argument years ago.

A decade ago, pulling off a ransomware attack required real technical skill: writing the malware, understanding how to evade antivirus, knowing how to move inside a network undetected, managing cryptocurrency collection infrastructure. That naturally limited who could do it.

The ransomware-as-a-service model removed that barrier. Today, criminal groups develop the malicious software and "rent" it out to other attackers — called affiliates — in exchange for a cut of the ransom, typically 70-80% for the affiliate and the rest for the malware developer. The affiliate doesn't need to know how to code anything. They just need a way into a network — often buying already-compromised access on underground forums — and the kit handles the rest: encryption, ransom note, negotiation panel with the victim.

That turned ransomware into a business with a full value chain, not the feat of a single sophisticated actor. And like any business that lowers its barrier to entry, the volume of "operators" grew exponentially.

It's tempting to assume the big headline-grabbing attacks represent most of the problem, but the operational reality of cybercrime is different: large companies usually have security budgets, dedicated teams, and resilience against an attack. Small businesses often have none of the three — and from the perspective of a ransomware-as-a-service affiliate looking to maximize return for minimum effort, that makes them a more efficient target, not a less attractive one.

Automated scanning also doesn't distinguish company size when choosing who to attack. It looks for specific vulnerabilities — open ports, unpatched software, credentials leaked in previous breaches — and attacks wherever it finds them, regardless of whether it's a multinational or a 22-employee auto parts distributor.

The most common pattern starts long before the ransom note ever appears. A phishing email tricks someone into handing over credentials, or an unpatched vulnerability allows direct access. The attacker — or the automated kit they bought — moves laterally inside the network, identifying which systems matter most, and in many cases exfiltrates data before encrypting anything, laying the groundwork for double extortion. Only then does encryption kick in, usually outside business hours, when there's less chance anyone notices in time.

There's no single measure that eliminates the problem, but these have the most real-world impact:

A ransomware attack that compromises personal data also triggers specific legal obligations — check our guide on when reporting a cyberattack is legally required in Colombia and on what Law 1273 says about computer damage.