Cisco Talos published its look at ransomware in Japan for the first half of 2026 today, and one number should stop every small business owner cold: 78% of victim organizations were small and mid-size companies, up from 69% a year earlier. Nearly half had capital under the equivalent of about $700,000. That is not enterprise territory. That is a dental practice, a machine shop, a three-partner law firm.
The pattern holds outside Japan. Big companies got better at this, so the gangs moved down-market to the places with one server, no security staff, and a firewall nobody has logged into since it was installed. Talos also found that Qilin, the second most active group in that data, is using AI to speed up its own operations. The attackers are getting more efficient while most small businesses are standing still.
Here is what to fix, in order. Start at the top.
1. Patch anything with a public IP this week
Your firewall, your VPN box, your email gateway. These are the front door now. Cisco just disclosed a critical SQL injection flaw in Secure Email Gateway, CVE-2026-76461, scored 9.8 out of 10, already exploited in the wild and already in CISA’s Known Exploited Vulnerabilities list. Separately, Talos is tracking active exploitation of Cisco Secure Firewall Management Center, where CVE-2026-20079 rates a perfect 10.0. One of the groups Talos caught inside those devices behaved like a Qilin ransomware affiliate: reconnaissance, tunneling tools, credential harvesting, then a target list of machines to encrypt. This is exactly the path we described when ransomware crews started hammering SonicWall remote access. Edge device, then everything else.
2. Turn on MFA for remote access and every admin account
No exceptions for the owner, the bookkeeper, or the guy who “just needs it to work.” A stolen password with no second factor is the cheapest way into your network, and it costs an attacker nothing.
3. Stop treating Windows shadow copies as a backup
Volume Shadow Copy Service is the feature behind “previous versions” on a Windows file server. Ransomware crews delete those copies as a standard step before they encrypt anything, specifically so you cannot roll back. Huntress also points out a second use: attackers create a shadow copy to quietly steal the Active Directory password database out of it instead of running noisy credential tools on a live system. Shadow copies are convenient. They are not a recovery plan.
4. Get one copy of your data where ransomware cannot reach it
Offline, or immutable cloud storage that cannot be deleted or overwritten for a set number of days, even by an administrator account. If your backup lives on a drive plugged into the server, or in a cloud account your domain admin can log into, assume it burns with everything else. We set this up as part of cloud backup work for clients because it is the difference between a bad Tuesday and a closed business.
5. Actually restore something
Pick a folder. Restore it to a different machine. Time it. Most owners discover their backup problem during an incident, which is the worst possible moment to find out the job has been silently failing since March.
6. Put real endpoint detection on every machine, with a human watching
Antivirus looks for known bad files. Ransomware operations today use built-in Windows tools, legitimate remote access software, and the admin credentials they just stole, so there is often no “bad file” to find. Huntress makes the key point about alerting: a shadow copy deletion on its own is meaningless because backup agents and RMM tools do it routinely. It only matters alongside the context around it. That takes detection tuned for behavior plus somebody who reads the alert at 2am, which is what managed detection and response buys you.
7. Prioritize privilege-escalation patches on workstations and servers
Microsoft’s September update fixed 974 vulnerabilities, its largest batch ever, including two zero-days already being exploited. Both let an attacker raise their privileges on a Windows system. That is step two of almost every ransomware attack: get a foothold, then become administrator. You cannot test 974 fixes, so triage. Internet-facing first, then actively exploited flaws, then critical remote code execution.
8. Write down what you do in the first hour
One page. Who calls the insurance carrier. Who pulls the network cable. Who has the backup credentials, stored somewhere that is not the network being encrypted. Which lawyer handles the notification questions. Ten minutes of writing now saves a day of panic later.
What we handle
For clients, items 1, 3, 4, 6, and 7 run on our side: patching on a schedule, immutable backups with restore tests we can show you, and endpoint detection monitored by an engineer you can reach directly instead of a ticket queue. You still own the MFA decision and the phone list, because those are business calls, not technical ones.
The Talos numbers say the target has moved to companies your size. If you are not sure which of these eight you actually have covered, that is a short conversation. Book a free 15-minute consult.