Ransomware Target Selection: How Affiliates Pick Small Businesses Before Writing a Line of Code

Ransomware target selection is not random — and it never was. What 2024 and early 2025 incident response data now confirms is that the decision to attack a specific small business is typically made days or weeks before any malicious code runs, based entirely on public information the business itself put out there. The first malicious packet is not the start of an attack. It is closer to the end of the planning phase. Understanding how that selection process works changes everything about how a small business should defend itself.

The Myth of the Random Attack

The popular image of a ransomware attack is a lone actor scanning the internet and stumbling onto a vulnerable machine. That image is wrong. According to the FBI’s 2023 Internet Crime Report — the most recent fully published edition — ransomware complaints reached 2,825 incidents with adjusted losses exceeding $59.6 million, and the FBI explicitly notes that reported figures represent a fraction of actual incidents. What the data behind those numbers shows is a pattern of deliberate, research-driven ransomware target selection.

Modern ransomware operations are structured businesses. They run affiliates, revenue shares, and customer support desks. The people deploying ransomware are not always the people who built it. And the people choosing targets are often not the people doing either. That separation matters enormously for understanding why small businesses are now a primary target class.

How the Ransomware Affiliate Model Changes Who Gets Hit

Ransomware-as-a-service operations split the work into distinct roles. Developers build and maintain the ransomware platform. Affiliates license access to it, conduct their own targeting research, execute intrusions, and collect a percentage of ransom payments — typically 70 to 80 percent. Initial access brokers operate as a third layer: they specialize entirely in gaining a foothold inside networks and selling that access to affiliates through underground forums.

This structure has a direct consequence for small businesses. Affiliates are economically motivated to maximize return on effort. A $2 million demand against a mid-market company sounds better on paper, but those companies have security teams, incident response retainers, and insurance carriers who negotiate hard. A $75,000 demand against a 30-person professional services firm with no IT staff and no backup discipline is a faster, cleaner transaction. Volume and predictability win over headline numbers.

CISA’s StopRansomware advisories published throughout 2024 repeatedly note that affiliates are applying the same reconnaissance tradecraft previously associated with nation-state actors — accelerated and commoditized — directly toward small and mid-size businesses.

The Specific Signals Affiliates Look For in Ransomware Target Selection

Affiliate targeting research is not guesswork. Forum disclosures from law enforcement takedowns and incident response case data have given the security community a clearer picture than ever before of what moves a business from “candidate” to “confirmed target.” The list is specific, and uncomfortable for most small business owners.

Exposed Remote Access Infrastructure

The single most consistent pre-attack signal across 2024 incident response engagements is an internet-facing remote access service — most commonly Remote Desktop Protocol on a standard port, or a virtual private network appliance running firmware that has not been updated in six months or more. Automated scanning tools index these exposures across the entire internet continuously. Shodan, Censys, and similar platforms are not hacker tools — they are public services. Affiliates use them as a first filter in ransomware target selection.

A business appears on that filter not because it did something wrong recently, but because its infrastructure has been passively visible for months or years. The exposure predates the targeting decision by an average of 150 days, based on breach timeline analysis documented in multiple 2024 incident response reports from Mandiant and Palo Alto Networks Unit 42.

Outdated or Unpatched Public-Facing Applications

Web applications, file transfer utilities, and edge devices running known-vulnerable software are a second filter layer. After a critical vulnerability is published, the window before active exploitation has compressed dramatically. The 2024 Verizon Data Breach Investigations Report found that exploitation of vulnerabilities as an initial access vector grew 180 percent year-over-year. Affiliates scan for version banners on public-facing services and cross-reference against published vulnerability databases — a process that takes seconds per target using automated tooling.

Size and Revenue Signals

Affiliates want to know whether a target can pay. They look at employee count on LinkedIn, revenue estimates on data aggregator sites like ZoomInfo and Dun & Bradstreet, and industry classification codes in public business filings. A 25-person firm in a regulated industry — accounting, legal, healthcare-adjacent, financial services — hits a sweet spot: small enough to lack dedicated security staff, large enough to have data worth encrypting, and operating in an industry where downtime creates immediate regulatory or client pressure to pay quickly.

Cyber Insurance Signals

This is the detail that surprises most business owners. Affiliates actively seek signals that a target carries cyber insurance. Job postings are one source — a posting for a “compliance manager” or “IT security coordinator” that mentions insurance requirements tells an affiliate that coverage exists and suggests a payment ceiling. Industry conference sponsorships, press releases about security certifications, and vendor case studies have all been cited in post-incident analysis as research inputs. The logic is direct: insured targets pay faster and with less friction, making them more attractive ransomware victims.

Social Media Footprints as Attack Intelligence

LinkedIn is the most consequential social media platform for ransomware target selection, and almost no small business treats it that way. An affiliate reviewing a target company’s LinkedIn page can extract the following within ten minutes, with no technical tools:

• Employee count and approximate growth trajectory
• Whether the company has a dedicated IT or security function
• Names and tenure of executives — useful for business email compromise layered onto a ransomware campaign
• Technology stack signals from employee skill endorsements and job descriptions
• Whether key IT staff recently departed — a gap period is a targeting opportunity

Twitter and Facebook add a different signal layer. Business owners who post about operational disruptions, technology frustrations, or recent system migrations inadvertently broadcast vulnerability windows. A post celebrating a new cloud migration tells an attacker the company is mid-transition — historically one of the most exposed moments in any organization’s infrastructure lifecycle.

Employee posts compound the exposure. Staff who post about working from home on personal devices, check in from client offices in regulated industries, or share screenshots of internal tools — even with sensitive data cropped out — are providing reconnaissance value that would have required active intrusion to gather a decade ago.

Industry Databases and Public Filings

Beyond social media, affiliates use publicly available structured data sources that most business owners have never thought of as security-relevant:

• State business registry filings reveal registered agent information, ownership structure, and officer contact details
• SEC EDGAR filings disclose revenue, client concentration, and technology risks in plain language
• Healthcare provider directories required under federal rules expose practice size, specialties, and electronic health record system names
• Court records and financing filings reveal lender relationships and sometimes technology vendor names
• Government contractor databases like SAM.gov expose industry codes, contract values, and system certifications that signal what data a firm handles

Each source individually looks innocuous. Aggregated against a specific company, they produce a targeting profile a skilled affiliate can build in under an hour — before touching the company’s network at all. This aggregated open-source intelligence is the true engine of modern ransomware target selection.

What the 2024–2025 Data Actually Shows

The Chainalysis 2025 Crypto Crime Report documented that ransomware payments in 2024 exceeded $1.1 billion for the second consecutive year — despite law enforcement takedowns of major groups including LockBit and ALPHV/BlackCat. Payment volume persisted because the affiliate model distributes operational risk across dozens of independent actors. Disrupting one group does not disrupt the market.

Unit 42’s 2024 Incident Response Report found that in 45 percent of ransomware cases investigated, the attacker had been present in the environment for more than a week before deploying ransomware. In 14 percent of cases, dwell time exceeded a month. That dwell time is not the reconnaissance phase — reconnaissance ended before the attacker entered the network. Time inside the environment is used to identify the most valuable data, disable backup systems, and maximize leverage before encryption begins.

The implication is significant: by the time a business discovers a breach, the ransomware target selection decision was made weeks or months earlier, the access was purchased or obtained, the environment was mapped, and the attack was staged. The encryption event is the last step, not the first.

One pattern documented across multiple 2024 incident response engagements involved professional services firms — specifically accounting and legal practices with 10 to 50 employees — that had no dedicated IT function. In each case, the access vector was a remote desktop service that had been internet-facing for over a year. The affiliate had purchased credentials from an initial access broker who catalogued the exposure months earlier and waited for a buyer.

Shifting the Defense: What You Can Do Before They Look

If ransomware target selection is driven by public signals, then reducing your public attack surface is a measurable security strategy — not just good hygiene. The defensive posture that follows from understanding the targeting process looks different from a standard checklist.

Conduct an External Attack Surface Review Regularly

Your IT firm should be able to tell you, at any point in time, exactly what your company looks like from the open internet: what ports are open, what services are exposed, what version banners are visible, what subdomains exist. This is not a one-time exercise — it is a recurring operational discipline. If your current IT firm cannot produce that answer within 24 hours of being asked, that gap is itself a risk signal.

Treat LinkedIn and Company Web Properties as Attack Surface

Audit what your company’s LinkedIn profile reveals about your technology stack and staffing. Job postings in particular should be reviewed before publication — a posting that names specific software platforms or describes a gap in your IT function is a ransomware target selection signal. This does not mean going dark; it means being deliberate about what you broadcast.

Patch Public-Facing Systems on a Defined Cycle

Edge devices, remote access gateways, and web-facing applications should be patched on a cycle that keeps you out of “known-vulnerable” scan results. When a critical vulnerability is published, the window to patch before active exploitation is measured in days, not weeks. Your IT firm should have a documented process for emergency patching — and you should know what that process is. NIST’s Cybersecurity Framework provides a practical baseline for patch management.

Eliminate Unnecessary Remote Access Exposure

Remote access to internal systems should require multiple layers of verification and should not be visible to the open internet without that protection in place. Any remote access service running without current multi-factor authentication is a visible signal to affiliate targeting tools. Closing that exposure is one of the highest-return security investments a small business can make.

Harden Your Backup Architecture Against Affiliate Tactics

Affiliates specifically identify and disable backup systems during their dwell period. Backups that are reachable over your network are not protected backups. Immutable, air-gapped, or cloud-isolated backups — ones that a compromised account cannot reach — are the only architecture that survives a professional affiliate operation. Whether your backups fit that description is a question worth asking today.

Our cybersecurity practice is built around exactly this kind of external-facing discipline — identifying and closing the signals that move a business onto an affiliate’s target list before any attacker arrives. Our managed IT services provide the ongoing monitoring that keeps that posture current.

What to Ask Your IT Firm Right Now

Shifting from reactive defense to pre-targeting defense means asking different questions. Based on what 2024 and 2025 data reveals about how affiliates select targets, these are the questions that matter most:

• Can you show me what our company looks like from the open internet today — every exposed service, port, and application version?
• How quickly do you patch critical vulnerabilities on our public-facing systems after one is published?
• Are our remote access systems protected by multi-factor authentication, and are they visible to open internet scanners?
• Are our backups stored where a compromised account cannot reach or delete them?
• Have you reviewed our LinkedIn and job postings for technology signals that could inform a ransomware target selection decision?
• Do you monitor whether our credentials have appeared in data broker or underground forum leaks?

If the answers are vague, delayed, or framed as future work rather than current operational facts, that gap is a risk worth taking seriously today.

The most important insight from 2024 and 2025 incident response data is not about the sophistication of ransomware code. It is simpler and more actionable: ransomware target selection is deliberate, and attackers use information businesses make available voluntarily. Closing the signals that invite targeting is not a technical problem — it is a management decision. The businesses that act on this earliest will not be the most secure by accident. They will be the ones that stopped looking like easy targets before an affiliate ever looked their way.

If you want to know what your business looks like from the outside right now, Book a Free Cybersecurity Strategy Call. It is a 20-minute conversation — no sales pressure, no obligation.