Kaspersky Digital Footprint Intelligence research reveals that small and medium-sized businesses are increasingly targeted by cybercriminals selling stolen access on dark web forums.
Small and medium-sized businesses (SMBs) are becoming major targets in the cybercrime economy, with more than half of analyzed dark web listings for initial access in 2026 involving compromised small and medium-sized organizations, according to new research from Kaspersky Digital Footprint Intelligence.
The study analyzed hundreds of posts from initial access brokers published on dark web markets between January and April 2025 and January and April 2026. Initial access brokers are cybercriminals who sell unauthorized entry into compromised company systems, allowing other attackers to launch ransomware attacks, steal confidential information, or conduct fraud.
SMBs account for majority of dark web access listings
Kaspersky found that in the first four months of 2026, listings involving compromised small organizations represented 40% of all analyzed initial access offers. Medium-sized organizations accounted for 20% of the posts.
Combined, small and medium-sized businesses represented more than half of all initial access listings analyzed by Kaspersky.
Cybercriminals often advertise compromised access by sharing details such as company location, industry, revenue, and the type of access available. Buyers can then use this access for various malicious activities, including ransomware deployment and corporate data theft.
Attackers exploit weaker security defenses
Kaspersky said the belief that SMBs are not attractive targets for attackers is a misconception. While large enterprises may have higher-value data, smaller organizations can be targeted because they often have fewer cybersecurity resources and less mature security defenses.
“Companies of any size need to understand the cyberthreat landscape, adhere to cybersecurity policies, use appropriate cybersecurity solutions, and continuously improve employees’ awareness,” said Ekaterina Beloborodova, Kaspersky Digital Footprint Intelligence Analyst.
Cybersecurity measures for SMB protection
Kaspersky recommends that businesses strengthen their defenses by adopting cybersecurity strategies suited to their size and operational needs, including:
- Using scalable security solutions designed for SMB environments.
- Implementing managed security services for organizations without dedicated cybersecurity teams.
- Monitoring surface, deep, and dark web activity for leaked credentials, exposed data, and impersonation attempts.
- Establishing clear access policies for company systems, email accounts, shared files, and online resources.
- Regularly backing up critical business data to reduce the impact of cyber incidents.
Kaspersky also highlighted solutions such as Kaspersky Small Office Security Premium, Kaspersky Next Optimum, Kaspersky MDR, and Kaspersky Digital Footprint Intelligence as tools that can help businesses improve threat detection, response, and digital risk monitoring.
As cybercriminals continue to expand their operations through dark web marketplaces, Kaspersky emphasized that businesses of all sizes need proactive cybersecurity strategies to protect their digital assets.
