# Ransomware Targeting of Small and Medium-Sized Businesses: Credential Theft, Unpatched Edge Devices, BYOVD and Backup Targeting

> Per the Verizon 2026 DBIR as summarized by Halcyon, about 96% of ransomware victims of known size were SMBs with fewer than 1,000 employees, and ransomware appeared in 83% of breaches at those businesses. Initial access was via stolen credentials (38%) or unpatched edge devices (29%), followed by legitimate admin tool use, BYOVD-based security tampering, pre-encryption data theft and backup targeting.

- **Published:** 2026-11-02T21:28:50Z
- **Last reviewed:** 2026-11-02T21:28:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5098
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5098.png
- **ID:** TL-2026-5098
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

This record documents a ransomware trend rather than a single incident or named campaign. The source is a Halcyon blog post by Kevin Gee (published 2026-11-02) that aggregates statistics from the Verizon 2026 Data Breach Investigations Report (DBIR), Sophos, Veeam, Arctic Wolf, Marsh and a 2025 Mastercard study. No CVEs, malware families, threat actors, hashes or network indicators are named in the article.

According to the Verizon 2026 DBIR as quoted by Halcyon and corroborated by the Cyber Readiness Institute's summary, about 96% of ransomware victims of known size were small or medium-sized businesses (fewer than 1,000 employees) and ransomware appeared in 83% of breaches at those businesses. Initial access at SMBs was attributed to compromised credentials (38%) and unpatched vulnerabilities in edge devices (29%). The Cyber Readiness Institute summary adds that 73% of ransomware victims experienced an infostealer or credential compromise beforehand, and 50% of those had credentials stolen within the 95 days before the ransomware incident. It also reports that 69% of SMBs refused to pay ransom demands because they maintained reliable backups.

The article describes the following attack pattern: access through stolen credentials or unpatched edge devices; lateral movement using legitimate administrative tools; Bring Your Own Vulnerable Driver (BYOVD) to disable endpoint security; data exfiltration before encryption (double extortion); and targeting of backups. The article attributes to Arctic Wolf that data theft occurs in 96% of ransomware attacks, and to Sophos that 94% of ransomware attacks attempt to compromise backups. Sophos is cited for average recovery cost of $638,536 for 100-250 employee organizations; Veeam for an average recovery time of 22 days with 72% of victims not fully recovering data. Halcyon reports in its ROC Star Report that nearly 99% of alerts were caught in earliest attack stages before exfiltration or encryption.

Defender relevance: because specific tooling and drivers are not named, detection should focus on behaviors: anomalous valid-account logons (especially following infostealer exposure), exploitation or anomalous access of internet-facing edge devices, new kernel driver loads and security-service tampering, use of remote administration tooling, bulk outbound data transfer, and backup deletion or tampering. No actor attribution is made; a related Silent Ransom Group alert was noted in the hunt rationale but is not mentioned in the source article and is not used for attribution.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1555 Credentials from Password Stores
- T1685 Disable or Modify Tools
- T1021 Remote Services
- T1219 Remote Access Tools
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Stolen Valid Account Replay - Failed Then Successful Remote Logon From Public IP (T1078, T1110.004, T1133)** (`TL-2026-5098-SPL-001`)

TL-2026-5098: Detects a public source IP that produces repeated failed network/RDP logons followed by at least one success against Windows hosts, the telemetry pattern of stolen or infostealer-sourced valid credentials being replayed (credential stuffing) against internet-exposed RDP/SMB. Verizon 2026 DBIR via Halcyon: compromised credentials are the initial access vector in 38% of SMB ransomware cases, and 73% of ransomware victims had an infostealer/credential compromise beforehand (50% within the prior 95 days). The Sentinel flavor also unions Entra ID sign-in logs so cloud-account replay is covered.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078, T1110.004, T1133
- **Data sources:** wineventlog:Security, SecurityEvent, SigninLogs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=wineventlog sourcetype="WinEventLog:Security" earliest=-24h (EventCode=4624 OR EventCode=4625) Logon_Type IN (3,10) NOT Source_Network_Address IN ("-","::1","127.0.0.1") ```Stolen-credential replay (T1078, T1110.004, T1133, TL-2026-5098): repeated failures then success from a public source``` | eval outcome=if(EventCode=4624,"success","failure") | stats count(eval(outcome="failure")) AS failures count(eval(outcome="success")) AS successes dc(user) AS distinct_users values(user) AS users values(Logon_Type) AS logon_types earliest(_time) AS first_seen latest(_time) AS last_seen BY Source_Network_Address | where failures>=5 AND successes>=1 | where NOT (cidrmatch("10.0.0.0/8",Source_Network_Address) OR cidrmatch("172.16.0.0/12",Source_Network_Address) OR cidrmatch("192.168.0.0/16",Source_Network_Address) OR cidrmatch("169.254.0.0/16",Source_Network_Address)) | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table Source_Network_Address failures successes distinct_users users logon_types first_seen last_seen
````

### Microsoft KQL

```kql
let winLogons = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4624, 4625) and LogonType in (3, 10)
| where isnotempty(IpAddress) and IpAddress !in ("-", "::1", "127.0.0.1") and not(ipv4_is_private(IpAddress))
| summarize Failures = countif(EventID == 4625), Successes = countif(EventID == 4624), Users = make_set(TargetUserName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IpAddress
| extend Source = "WindowsSecurity";
let entraLogons = SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType in ("0", "50126", "50053", "50057")
| where not(ipv4_is_private(IPAddress))
| summarize Failures = countif(ResultType != "0"), Successes = countif(ResultType == "0"), Users = make_set(UserPrincipalName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IpAddress = IPAddress
| extend Source = "EntraID";
union winLogons, entraLogons
| where Failures >= 5 and Successes >= 1
| project Source, IpAddress, Failures, Successes, Users, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Remote Interactive Logon From Public IP Address (Valid Accounts)
id: 6b1f0c52-3a7e-4d19-9c64-2f8a1e5b7d01
status: experimental
description: Detects successful Windows RDP logons originating from non-RFC1918 addresses, a common outcome of stolen-credential or infostealer-sourced access to SMB environments that precedes ransomware (TL-2026-5098).
references:
    - https://www.halcyon.ai/blog/ransomware-protection-for-small-businesses
    - https://verizon.com/DBIR
    - https://attack.mitre.org/techniques/T1078/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1078
    - attack.t1133
    - attack.credential_access
    - attack.t1110.004
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    filter_private:
        IpAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '127.0.0.0/8'
    filter_local:
        IpAddress:
            - '-'
            - '::1'
    condition: selection and not 1 of filter_*
falsepositives:
    - Administrators or MSPs connecting over RDP through a public gateway
    - Remote staff on home networks where RDP is intentionally published behind NLA
level: medium
```

**Known false positives:**

- Remote staff or MSPs legitimately logging on from public IPs after mistyped passwords
- Vulnerability scanners or monitoring probes that authenticate over the network
- Shared NAT egress addresses where several users fail then succeed

**Tuning notes:** Add known corporate egress, VPN concentrator and MSP IP ranges to an exclusion lookup; raise the failure threshold in noisy environments; require distinct_users>=2 to emphasise credential stuffing; correlate hits with infostealer-exposure feeds (credentials stolen in the prior 95 days) for the affected accounts; enforce MFA and remove direct RDP exposure.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Edge Device Exploitation Attempts Against VPN and Gateway Management Paths (T1190, T1133) (locked: unlock with TL Creds)
- Backup and Recovery Destruction Plus Ransom Note Staging Before Encryption (T1490, T1489, T1486) (locked: unlock with TL Creds)
- Unsanctioned ScreenConnect Remote Access Client Install, Service and Relay Activity (T1219, T1543.003, T1105) (locked: unlock with TL Creds)
- Credential Store Harvesting - Vault, Browser and Stealer Tool Commands (T1555, T1555.003, T1555.004) (locked: unlock with TL Creds)
- Lateral Movement With Legitimate Admin Tools - PsExec, WinRS, WMI, PowerShell Remoting, Impacket-Style ADMIN$ (T1021, T1021.002, T1021.006, T1047) (locked: unlock with TL Creds)
- Pre-Encryption Data Exfiltration and Staging - rclone, MEGAcmd, pscp, WinSCP, Archive Tools (T1041, T1567.002, T1048, T1560.001) (locked: unlock with TL Creds)
- BYOVD - Known-Vulnerable Driver Load or Kernel Driver Service From Writable Path (T1068, T1562.001, T1543.003) (locked: unlock with TL Creds)
- Endpoint Security Tampering - Service Stop, Defender Disablement and Registry Policy Changes (T1562.001, T1489, T1112) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Ransomware Protection for Small Businesses: Your Size Is the Attacker's Advantage](https://www.halcyon.ai/blog/ransomware-protection-for-small-businesses)
- [Verizon 2026 Data Breach Investigations Report](https://verizon.com/DBIR)
- [2026 Verizon Cyber Report: Small Businesses Face Escalating Cyber Threats as Human Error and Ransomware Drive Breaches (Cyber Readiness Institute)](https://cyberreadinessinstitute.org/news-and-events/verizon-dbir-2026-small-businesses-face-escalating-cyber-threats/)
- [Halcyon ROC Star Report](https://www.halcyon.ai/resources/reports/roc-star-report-september-2026)
- [2026 Verizon DBIR: The New Era of Cyber Threats (eSecurity Planet)](https://www.esecurityplanet.com/de/threats/2026-verizon-dbir-the-new-era-of-cyber-threats/)
- [CSA Research Note: Silent Ransom Group Vishing and Physical Intrusion at Law Firms (related context only)](https://labs.cloudsecurityalliance.org/research/csa-research-note-unc3753-silent-ransom-vishing-physical-int/)
- [Dark Reading: Ransomware Actors Show Up In Person to Steal Law Firm Data (related context only)](https://darkreading.com/cyberattacks-data-breaches/ransomware-actors-steal-law-firm-data)
- [FBI Cyber Security Advisory: Silent Ransom Group (related context only)](https://ic3.gov/CSA/2025/250523.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5098