Small and Medium Businesses Remain Prime Cybercrime Targets: Kaspersky
Kaspersky says 60 percent of dark web advertisements selling unauthorized access to business networks in early 2026 targeted small and medium-sized businesses, highlighting the growing cyber risks facing SMBs.
Small and medium-sized businesses (SMBs) continue to be among the primary targets of cybercriminals, according to global cybersecurity company Kaspersky. In a report released to mark International MSME Day, the company revealed that 60 percent of dark web advertisements offering unauthorized access to corporate networks between January and April 2026 were related to small and medium-sized businesses.
The report found that 40 percent of the advertisements targeted small businesses, while another 20 percent focused on medium-sized enterprises. The findings suggest that SMBs remain attractive targets due to comparatively limited cybersecurity capabilities.
According to Kaspersky, cybercriminals often sell initial access to compromised corporate networks to other threat actors, who later use that access to launch ransomware attacks, steal sensitive information, or conduct other forms of cybercrime.
Ekaterina Beloborodova, Digital Footprint Intelligence Analyst at Kaspersky, said medium-sized businesses are particularly attractive because they generally generate higher revenue than small companies but often lack the robust cybersecurity infrastructure of large enterprises.
She emphasized that organizations of all sizes should remain vigilant by implementing strong cybersecurity policies, deploying appropriate security solutions, and providing regular cybersecurity awareness training for employees.
To strengthen cyber resilience, Kaspersky recommends adopting security solutions tailored to organizational needs. Businesses with limited or no in-house IT security teams are advised to consider Managed Detection and Response (MDR) services for continuous threat monitoring and expert incident response.
The company also recommends monitoring the dark web for leaked credentials, establishing clear policies for the use of AI tools and online services, enforcing strict access controls for corporate accounts, and maintaining regular backups of critical business data.
//DBTech/RI/MI//
