Exploring the Digital Underground to Safeguard SMBs

Cybercriminals are constantly evolving their tactics, leveraging hidden corners of the internet to sell access to small and medium-sized businesses (SMBs). To stay ahead of these threats, the Guardz Research Unit (GRU) continuously monitors dark web marketplaces, underground forums, and other cybercrime hubs to uncover the latest trends that put SMBs at risk.

Our latest investigation has revealed a concerning rise in cybercriminal services tailored specifically to targeting SMBs, including law and accounting firms. One alarming example: a dark web listing offering admin-level access to a U.S. law firm for just $600, exploiting an eight-year-old unpatched vulnerability.

This finding is just one of many that highlight the growing attack-as-a-service economy, where cybercriminals trade stolen credentials, exploit remote access systems, and sell persistent backdoor access, leaving businesses vulnerable to ransomware, fraud, and devastating reputational damage.

Key Trends Uncovered by the Guardz Research Unit:

• Stolen Business Access for Sale – Dark web marketplaces feature listings for Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) credentials, granting full control over small business networks.
• Cybercrime is Alarmingly Affordable – Attackers can purchase unauthorized access to SMBs, including law firms and accounting firms, at shockingly low prices, making these businesses prime targets for fraud and extortion.
• Unpatched Vulnerabilities Fuel Attacks – Businesses failing to patch old security flaws remain wide open to breaches, with cybercriminals exploiting security gaps that have been disclosed for years.
•  Persistent Access and Long-Term Exploitation – Many attacks don’t end after initial access; criminals implant malware, keyloggers, and hidden backdoors, allowing them to return undetected for future data theft and extortion.

Why This Matters for SMBs

Small businesses, especially those handling sensitive financial and legal data, remain a primary focus of cybercriminal activity. The Guardz Research Unit is working to expose these threats in real-time so that SMBs can take proactive steps to secure their networks before they become the next target.

Cybercriminals innovate their tactics daily, so cybersecurity defenses must evolve just as fast. By staying informed on emerging threats, SMBs can adopt a proactive security approach to protect themselves, their clients, and their reputations.

At Guardz, we are committed to helping SMBs close security gaps and prevent breaches before they happen. Stay tuned for our full report, where we’ll dive deeper into the latest dark web discoveries and provide actionable security strategies to keep your business safe.

Protecting Those at Risk

As part of this investigation, Guardz identified a law firm that was specifically named within dark web forums. We took immediate steps to notify the firm, ensuring they are aware of the threat and can take appropriate measures to protect their systems. Guardz remains available to assist in securing their business and mitigating potential risks.

Additionally, in our published report, we have not disclosed any company names, identifiers, or details that could expose businesses to further threats. Our mission is to raise awareness and equip SMBs with the insights and tools they need to defend against cyber risks.

Findings from the Dark Web

GRU’s recent dive into dark web forums revealed an alarming trend: threat actors are actively targeting Small businesses, particularly law and accounting firms. The reasons are clear—these organizations handle sensitive and lucrative data, such as financial records, legal documentation, and personally identifiable information (PII), making them attractive to cybercriminals.

Key GRU findings include:

• Exploitation of Unpatched Vulnerabilities: Over 15% of the analyzed dark web listings offered access to organizations through known vulnerabilities that had been disclosed years ago.
• Sale of Stolen Credentials: Credentials for Small businesses networks—both admin-level and standard user accounts—are being sold at an average price of $600. Some listings even include bundled “access packs” with multiple entry points to the same organization.
• Ransomware as a Service (RaaS): Cybercriminal groups are offering turnkey ransomware solutions on the dark web, making it easier than ever for even non-technical actors to launch devastating attacks.

These findings highlight the growing sophistication and accessibility of cybercrime, making Small businesses an increasingly vulnerable target.

Threat Analysis: How Small Businesses Are Being Exploited

1. Unpatched Vulnerabilities: A Ticking Time Bomb

In the Guardz Research Unit recent uncovered findings, an American law firm was still vulnerable to the EternalBlue exploit—a flaw in Windows’ Server Message Block (Small businesses) protocol disclosed back in 2017. This vulnerability was infamously exploited in the global WannaCry ransomware attack, which caused billions in damages. Despite being patched years ago, GRU found that threat actors were still leveraging it to gain access to unprotected networks.

The potential damage behind this vulnerability is equally alarming:

• According to various estimations, over 100,000 devices worldwide are estimated to remain unpatched against EternalBlue.
• A single ransomware attack exploiting this vulnerability can cost Small businesses an average of $120,000 in recovery expenses, not to mention reputational damage.

One dark web listing advertised admin-level access to a law firm’s network, complete with instructions on how to exploit the EternalBlue flaw, for just $600—a devastatingly low price for such significant access.

VPN Access to a law firm in Puerto Rico sold on the Darkweb

2. RDP and VPN Exploits: A Gateway for Attackers

Remote Desktop Protocol (RDP) and Virtual Private Network (VPN) tools are critical for enabling remote work, but they have also become prime targets for cybercriminals. GRU identified multiple listings on dark web forums advertising access to small business networks through compromised RDP and VPN credentials.

• High-Value Credentials: In one case, admin-level RDP credentials for an accounting firm were auctioned off for $1,800, giving the buyer unrestricted access to sensitive financial systems.
• Low-Cost Entry Points: Lower-level credentials were available for as little as $300, yet they still offered significant opportunities for skilled attackers to escalate their access.

The potential threat here paints a grim picture:

• A 2024 study by the Cyber Readiness Institute found that nearly two-thirds (65%) of global SMBs do not use MFA and have no plans to implement it in the near future.

RDP Access to accounting firm Sold on DarkWeb

3. Ransomware: The Hall of Shame

Ransomware gangs have evolved their tactics beyond simple file encryption. Today, these groups often engage in double extortion, threatening to leak sensitive data if ransom demands are not met. GRU documented a particularly devastating example involving a U.S. family law firm. After refusing to pay a ransom, the firm’s sensitive client data was leaked on a dark web “hall of shame” site, resulting in irreparable reputational damage.

The impact of ransomware on Small businesses is staggering:

• Financial Losses: The average cost of a ransomware attack on small businesses is approximately $26,000.
   
• Operational Disruptions: Following a ransomware attack, 50% of small and medium-sized businesses report that it took 24 hours or longer to recover, leading to significant downtime and loss of productivity.

The Risk and Potential Damages to Small Businesses

The infiltration of a small business network via Remote Desktop Protocol (RDP), VPN exploits, or unpatched vulnerabilities can lead to severe and often irreversible consequences. Once cybercriminals gain access, they can:

• Deploy Ransomware: Attackers can encrypt all business-critical files, rendering systems inoperable until a ransom is paid—often in cryptocurrency. Many businesses that refuse to pay suffer prolonged downtime, loss of sensitive client data, and legal repercussions if personally identifiable information (PII) is exposed.
• Steal and Sell Confidential Data: Law firms, accounting firms, and other professional service providers store sensitive financial records, legal case files, tax information, and personally identifiable data. Cybercriminals frequently sell or leak this data, leading to regulatory fines, lawsuits, and a loss of client trust.
• Launch Fraudulent Transactions: With admin-level access, attackers can manipulate financial records, initiate fraudulent wire transfers, or reroute funds, causing direct financial losses that can be difficult to recover.
• Set Up Persistent Access for Future Exploits: Many cybercriminals install backdoors, keyloggers, and other malware that allow them to return at will, siphon off data over time, or launch additional attacks without detection.
• Use the Business as a Springboard for Attacking Others: A compromised firm can be leveraged to infiltrate clients, suppliers, or business partners, especially if they have interconnected networks or shared credentials. This can trigger legal liability and reputational damage that extends far beyond the initial breach.
• Disrupt Operations for Extended Periods: For many small businesses, even a few days of downtime can be financially devastating. Attackers often sabotage systems, delete backups, or corrupt data to make recovery nearly impossible without external intervention.

Risks Amplified: Why Small Businesses Are Prime Targets

Small businesses often lack the resources and expertise of larger organizations, making them appealing targets for cybercriminals. Key risk factors include:

• Inadequate Security Budgets: Many Small businesses operate on tight budgets, often prioritizing operational costs over cybersecurity.
• Overlooked Patching: GRU’s findings show that many Small businesses fail to patch vulnerabilities in a timely manner, leaving them exposed to known threats.
• Weak Credential Policies: The reuse of passwords across multiple accounts remains a widespread issue, providing easy entry points for attackers.
• Supply Chain Vulnerabilities: Small businesses often rely on third-party vendors, creating additional attack vectors for cybercriminals.

Guardz: A Trusted Ally in Cybersecurity

As the cybersecurity landscape grows increasingly complex, Guardz is transforming the charge to protect small businesses. Through its innovative AI-powered platform, Guardz empowers MSPs to deliver cutting-edge cybersecurity solutions tailored to the needs of small businesses.

How Guardz Makes a Difference:

• Proactive Threat Detection: Guardz’s platform identifies vulnerabilities and mitigates risks before they can be exploited.
• Automated Responses: The platform provides real-time, automated responses to emerging threats, minimizing damage and downtime.
• Cyber Awareness Training: Guardz equips small businesses with the knowledge and tools to recognize and respond to social engineering attempts, such as phishing attacks.
• Phishing Simulations: To bolster defenses against one of the most common attack vectors, Guardz offers AI-powered phishing simulations, helping small businesses and their employees stay vigilant.

A Path Forward: Recommendations for Small Businesses

GRU’s findings serve as a wake-up call for small businesses across all sectors. To stay ahead of cybercriminals, small businesses must adopt a proactive approach to cybersecurity. Key recommendations include:

1. Regular Patch Management: Ensure all software and systems are up to date to eliminate known vulnerabilities.
2. Strong Credential Policies: Implement MFA and enforce unique, complex passwords across all accounts.
3. Data Backups: Maintain separate, secure backups of all critical data to ensure business continuity in the event of an attack.
4. Employee Training: Invest in ongoing cybersecurity awareness training to reduce the risk of human error.
5. Partner with an MSP: Work with a trusted MSP equipped with Guardz’s platform to ensure 24/7 protection.

The findings from the Guardz Research Unit highlight a sobering reality: the dark web is teeming with threats aimed squarely at small businesses. From unpatched vulnerabilities to stolen credentials and ransomware attacks, small businesses face a range of risks that can devastate their operations and reputations.

But it doesn’t have to be this way. By taking proactive measures and partnering with cybersecurity leaders like Guardz, small businesses can turn the tide, protecting their data, their clients, and their futures.

In an age where cybercrime shows no signs of slowing down, Guardz stands as a beacon of hope, empowering MSPs to safeguard the lifeblood of the economy and our small businesses. The message is clear: Stay vigilant, stay prepared, and let Guardz protect what matters most.