GUEST ESSAY: Cybercrime for hire: small businesses are the new bullseye of the Dark Web

Small businesses make up 90% of all companies worldwide and account for half of global GDP. Yet despite their importance, many lack the cybersecurity expertise and resources to fend off a rising tide of digital threats.

Related: Protecting lateral networks in SMBs

Rich in sensitive data and often connected to larger supply chains, small businesses have become prime targets for attackers. And thanks to an explosion of inexpensive “cybercrime-as-a-service” offerings on the dark web, launching an attack is easier — and cheaper — than ever.

Cybercrime industrialized

The dark web has become a marketplace where bad actors can buy tools and access with the ease of shopping for software. Many of these services exploit unpatched software flaws — some disclosed years ago — that remain active in business environments.

Recent Guardz research shows that more than 15% of the tools advertised on dark web forums target vulnerabilities like EternalBlue, a known Windows flaw dating back to 2017 that still hasn’t been fully remediated across the globe.

Attackers can also buy access to compromised remote desktop setups, VPN logins, and bundles of stolen credentials. Once inside, they can disrupt operations, steal or sell data, launch fraudulent transactions, or install ransomware to demand payouts. In some cases, pre-built ransomware kits — complete with instructions — are sold for just a few hundred dollars.

AI is fueling the fire

But easy access is just the start. AI is now supercharging these threats — helping cybercriminals scale attacks, tailor phishing lures, write malware, and even evade detection.

With automated tools, attackers can scan thousands of small business networks in moments, identifying weak points like outdated software or exposed accounts. Then, they can spin up hyper-personalized phishing emails, fine-tuned for each target, and blast them out at scale.

What’s more, AI-powered malware is being packaged in sleek, user-friendly bundles — complete with dashboards, walkthroughs, and even customer support. This dramatically lowers the barrier to entry and multiplies the number of threat actors.

The real-world fallout

The damage can be severe. Nearly 94% of ransomware victims experience extended downtime, and one in five breached companies ultimately shuts down. Paying a ransom doesn’t guarantee data recovery or confidentiality — and the reputational cost of leaked customer data can be irreversible.

Proactive Protection Without Breaking the Bank

It’s a myth that only large budgets can deliver meaningful cybersecurity. For small businesses, smart prioritization is key. That means:

•Training employees to recognize phishing and avoid risky behavior.

•Using AI-powered tools that can detect and stop threats faster than manual systems.

•Carrying cyber insurance that covers downtime, breaches, and ransomware.

•Partnering with a managed service provider (MSP) to build and maintain a scalable security strategy.

Small businesses, big targets

Cyberattacks that once required advanced skills are now just a few clicks away. Generative AI has made threats more scalable and more deceptive — and small businesses are increasingly the ones in the crosshairs.

The good news: with the right support and smart tools, SMBs can fight back. Whether it’s in-house or through an MSP, every organization deserves — and can afford — a proactive defense.

About the essayist: Doni Brass is the SVP of Product Strategy & Community at Guardz, a cybersecurity startup, he leads the mission to empower MSPs to make the digital world safer for small and medium-sized businesses.

The post GUEST ESSAY: Cybercrime for hire: small businesses are the new bullseye of the Dark Web first appeared on The Last Watchdog.