Ransomware Attacks on Australian SMBs Are Up 47% — Here's What You Need to Know

Ransomware is no longer a problem reserved for large enterprises. According to the Australian Cyber Security Centre's (ACSC) annual threat reports, small and medium-sized businesses are now the primary target of ransomware groups — and the volume of reported incidents continues to climb year on year. Organisations with fewer than 200 staff in Australia face particular risk.

How a Ransomware Attack Actually Happens

Most attacks begin through one of three common entry points: phishing emails that compromise credentials, exposed Remote Desktop Protocol (RDP) ports subject to brute-force attacks, or vulnerabilities in unpatched software.

Following initial compromise, attackers conduct lateral movement, spending days or weeks mapping networks, identifying valuable data, locating backup systems, and escalating privileges to domain administrator status. Only then do they deploy ransomware payloads, encrypting systems within minutes.

This deliberate delay enables double extortion: attackers exfiltrate data before encryption, then demand payment both for decryption and to prevent data publication. Many modern ransomware groups operate a data leak site where they publicly list victims who refuse to pay.

Why SMBs Are Targeted

Small businesses often hold the same sensitive data categories as large organisations — client financials, health information, legal documents, and employee records — yet invest significantly less in security infrastructure.

A law firm with 15 staff may have no dedicated IT security person, no endpoint detection and response (EDR) tool, outdated firewall rules, and backups that haven't been tested in two years. Such organisations become attractive targets for ransom demands ranging from $50,000 to $500,000. Ransomware-as-a-Service (RaaS) platforms have industrialised attacks by offering subscription-based access to ransomware toolkits, enabling less sophisticated criminals to execute complex attacks.

The True Cost of a Ransomware Attack

Beyond ransom demands, costs include:

• Downtime: Average recovery time for an SMB is 5–21 days. Every day your systems are down, revenue stops.
• Incident Response: Forensic investigations typically cost $15,000–$80,000 for SMB-scale incidents.
• Data Breach Notification: Mandatory obligations exist under the Privacy Act 1988 and Notifiable Data Breaches scheme.
• Reputational Damage: Clients discovering compromised data frequently relocate their business.
• Ransom Payment Risk: Approximately 20% of paying organisations never receive functional decryption keys.

What Actually Works: Your Ransomware Defence Checklist

1. Immutable, Offsite Backups

Your backups are the single most important control against ransomware. Backups must be immutable and stored separately from your main network infrastructure. Quarterly restore testing is essential — a backup you haven't tested may not work when you need it most.

2. Endpoint Detection and Response (EDR)

Traditional antivirus misses novel ransomware strains. EDR tools use behavioural analysis to detect suspicious activities — such as processes encrypting thousands of files — and isolate affected machines. Recommended solutions include Bitdefender GravityZone and Microsoft Defender for Business.

3. Multi-Factor Authentication on Everything

If an attacker steals a password through phishing, MFA is often the only thing standing between them and your systems. MFA should protect Microsoft 365, VPN access, Remote Monitoring and Management tools, and all externally accessible systems. Phishing-resistant options like FIDO2 and passkeys offer enhanced protection.

4. Patch Management

Many high-profile ransomware campaigns exploit known vulnerabilities that had patches available for months before the attack. Structured patch management using RMM tools to deploy patches automatically significantly reduces your attack surface.

5. Close Exposed RDP

Direct internet exposure of Remote Desktop Protocol creates prime targeting opportunities. Disable direct RDP access and require connections through VPN or Zero Trust Network Access solutions.

Key Takeaways

• Ransomware attacks on Australian SMBs are expanding rapidly — organisational size provides insufficient protection.
• Attackers typically enter via phishing, exposed RDP, or unpatched software before spending weeks conducting network reconnaissance.
• Ransomware costs extend beyond ransom payments to include downtime, incident response, breach notifications, and reputational consequences.
• Immutable backups, EDR tools, MFA, and disciplined patching represent the most effective defensive measures.