How ransom attacks on small businesses open doors to larger organisations

Kaspersky says India's SMBs are becoming attractive ransomware targets as cybercriminals exploit weak security, growing digital adoption and deeper integration with enterprise supply chains

Data from cybersecurity company Kaspersky suggests ransomware attackers are steadily shifting their attention towards small and medium businesses (SMBs), many of which lack dedicated cybersecurity teams despite becoming increasingly digitised.

 

According to Kaspersky, ransomware detections among Indian SMBs increased from 3.18 per cent in the first quarter of 2025 to 4.07 per cent during the same period this year. While the increase may appear modest, the company says the trend reflects sustained targeting of smaller businesses rather than isolated spikes.

 

The actual threat could be significantly larger than these numbers suggest.

 

Jaydeep Singh, General Manager for India at Kaspersky, told Business Standard that the increase in ransomware detections tells only part of the story because it captures only the final stage of an attack.

 

 

"This number likely understates the real exposure, since detection statistics only capture the final stage of an attack, the encryption itself, not earlier stages like initial access or lateral movement, which often get caught in time," he said.

What is ransomware

Ransomware is a form of malware that encrypts an organisation's files or systems, making them inaccessible until a ransom is paid. Earlier attacks primarily relied on encryption to extort victims. Today's ransomware campaigns, however, have evolved into complex operations that often begin with stealing credentials, moving across networks and exfiltrating sensitive information long before files are encrypted.

That evolution means organisations can suffer significant damage even if they recover encrypted systems from backups, because attackers may still possess confidential business data that can later be leaked.

Why are Indian SMBs suddenly attractive

Ransomware gangs are not abandoning large enterprises. Instead, they are discovering that India's SMB sector has become valuable enough to target directly.

 

"The shift is not attackers moving away from large enterprises. It is that Indian SMBs are becoming valuable targets in their own right," Singh told Business Standard.

 

According to him, two developments have converged over the past year.

 

The first is the rapid expansion of India's digital economy. Small businesses increasingly rely on cloud applications, connected manufacturing systems, digital payments and online supply chains. The second is the growing sophistication of the ransomware ecosystem, which has lowered the technical barrier for launching attacks and attracted more cybercriminal groups into the ecosystem.

 

"Security gaps make SMBs easy to compromise. And a bigger, more organized attacker ecosystem makes targeting them more worthwhile than it was a year or so ago," Singh said.

India's digital growth is creating new cyber risks

India's MSME sector contributes about 31.1 per cent of GDP, 35.4 per cent of manufacturing output and nearly half of the country's exports. As businesses increasingly adopt cloud platforms, digital payments and connected manufacturing systems, they are becoming more deeply integrated into larger domestic and global supply chains.

 

That connectivity has also expanded the attack surface. Rather than attacking a multinational directly, ransomware operators increasingly view suppliers, logistics companies, IT vendors and manufacturing partners as potential pathways into larger enterprise networks.

"Direct ransom extraction from an SMB is still common. But as Indian SMBs digitise and connect deeper into larger enterprise and global supply chains, their systems are also becoming entry points into the bigger organisations they work with," Singh said.

 

He added that the changing tactics extend beyond simply locking files.

 

"For an SMB inside a supply chain, this changes the risk. It is no longer just about disruption to their own business. It is also about exposing data or access that puts their larger partners at risk too."

Ransomware has become a business

The evolution of ransomware itself is also contributing to the increase in attacks.

 

Kaspersky researchers have been tracking the rapid expansion of The Gentlemen, a ransomware-as-a-service group that emerged around mid-2025 and has already targeted manufacturing, IT services, healthcare, financial services, construction and logistics, sectors that represent a significant share of India's SMB economy.

 

Unlike traditional ransomware gangs, The Gentlemen uses custom-built malware and specialised tools to gather intelligence before deploying ransomware. Researchers identified a previously unknown Go-based backdoor capable of communicating with attackers, collecting network information and conducting reconnaissance long before encryption begins.

 

According to Kaspersky's Q1 2026 threat report, The Gentlemen already accounts for 9.25 per cent of victims listed on ransomware leak sites, overtaking established groups such as Akira and INC Ransom. Only Clop and Qilin currently rank ahead of it.

 

Singh said the rapid expansion of ransomware-as-a-service has fundamentally changed how cybercriminals operate.

 

"This model lowers the technical bar for launching attacks, so more groups are now hunting for less defended targets. SMBs, which still largely lack dedicated security teams and structured patch management, often fit that profile."

Which sectors are more exposed

According to Singh, the sectors currently seeing the highest ransomware activity include manufacturing, IT services, healthcare, financial services, construction and logistics.

 

However, attackers are not necessarily interested in what these companies produce.

 

"These sectors are not being targeted for what they produce. They are being targeted because they have grown digitised and interconnected faster than their security investment has kept up," he said.

 

Manufacturing illustrates the problem clearly.

 

"IT and operational technology are converging rapidly there, which has expanded the attack surface. At the same time, security budgets in the sector continue to trail behind more mature verticals like BFSI."

The ransomware playbook is changing

Ransomware today is no longer just about encrypting files. Kaspersky's State of Ransomware 2026 report shows attackers increasingly relying on encryptionless extortion, where stolen data, rather than locked systems, becomes the primary source of leverage.

 

Instead of simply demanding money for a decryption key, cybercriminals now steal confidential business information before threatening to leak it publicly if victims refuse to pay.

 

The report also highlights the growing role of specialised initial access brokers, groups that break into organisations and then sell that access to ransomware operators. Remote Desktop Protocol, VPN services and internet-facing remote access portals continue to be among the most common entry points.   

AI is becoming cybercriminals' newest lure

Artificial intelligence is also beginning to reshape ransomware attacks, although not necessarily through fully autonomous hacking.

 

According to Singh, attackers are currently exploiting growing trust in AI tools faster than they are using AI to automate attacks.

 

"Generative AI is already changing ransomware activity, though the most visible impact so far is attackers using trust in AI tools as a lure, rather than running fully AI driven attacks from start to finish," he said.

 

Kaspersky's SMB Threat Report found attacks disguised as popular AI services surged nearly five-fold during the first four months of 2026 compared with the same period last year. More than 33,300 such attacks targeted SMBs, while globally researchers detected over 92,000 malware attacks disguised as AI agents and services, with fake ChatGPT installers accounting for roughly half.

 

"This tells us attackers are exploiting the trust people place in AI brands faster than most SMBs are learning to question it," Singh said.

 

As AI tools become part of everyday business operations, recognising fake AI applications and AI-generated lures is becoming as important as identifying phishing emails.

The biggest gaps remain basic cybersecurity

Despite increasingly sophisticated ransomware campaigns, Singh believes the biggest weaknesses among Indian SMBs remain surprisingly basic.

 

"The gaps we continue to see are foundational. Many Indian SMBs still lack dedicated security teams, structured patch management, and reliable backup strategies. Many also cannot absorb the cost of forensics or rapid remediation once an incident occurs," he said.

 

He added that many businesses continue to believe backups alone provide adequate protection.

 

"A common misconception is that having a backup alone is enough protection. But most modern ransomware operators now run double extortion campaigns. They exfiltrate data alongside encrypting it. This makes backups necessary but not sufficient on their own."

 

Another overlooked area is the ability to detect attacks before ransomware is deployed.

 

"The other recurring blind spot is visibility into outbound traffic and lateral movement. Most SMB security investment still goes toward basic endpoint protection, rather than the detection and response layer needed to catch an attack before the final encryption stage."

 

Singh also pointed to a regulatory challenge.

 

"More than 83 per cent of Indian organisations are yet to begin comprehensive DPDP (Digital Personal Data Protection) implementation, which leaves many SMBs unprepared for both the security and regulatory fallout of an incident."

 

For India's rapidly digitising MSME sector, cybersecurity is becoming inseparable from business resilience. As businesses become more deeply embedded within domestic and global supply chains, ransomware is no longer simply an enterprise problem. Increasingly, it is becoming a strategic business risk for the country's smallest companies as well.