The threat landscape for Indian small and mid-sized businesses

1. What you will learn

Before choosing controls, you need a realistic picture of who attacks businesses like yours and how. This lesson surveys the main threats facing Indian small and mid-sized enterprises. You will learn to:

• describe the main threat actor types and their motives;
• explain how ransomware, business e-mail compromise, payment fraud, malware and insider threats work;
• recognise the stages of a typical attack using the idea of an attack chain;
• match threats to your own business profile so that later risk assessment is grounded.

2. The idea explained

Threat actors and motives

• Financially motivated criminals are the largest group affecting small businesses. They want money directly (fraudulent transfers, ransom) or indirectly (selling stolen data or access). Many operate as organised groups offering ransomware-as-a-service, where developers rent tools to affiliates.
• Opportunistic attackers use automated scanning to find any exposed, unpatched system or weak password. They do not choose you by name; they find you by weakness.
• Insiders are current or former employees, contractors or partners who misuse legitimate access, deliberately or through carelessness.
• Competitors or disgruntled parties may seek customer lists, pricing or designs.
• Hacktivists deface websites or leak data for a cause; state-linked actors mainly target government, defence and critical sectors, though suppliers to those sectors can be caught up.

Major threat types

Phishing and social engineering. Social engineering manipulates people into doing something harmful: clicking a link, opening an attachment, revealing a password or OTP, or making a payment. Phishing uses e-mail; smishing uses SMS; vishing uses voice calls; messaging-app scams follow the same pattern. It is the most common entry point for other attacks.

Business e-mail compromise (BEC). An attacker either takes over a genuine business e-mail account or impersonates it with a look-alike domain, then sends convincing instructions: "Our bank account has changed, please pay this invoice to the new account", or "I am in a meeting, transfer this amount urgently". Losses can be large because payments go through normal banking channels and are authorised by the victim's own staff.

Ransomware. Malicious software that encrypts files and systems, followed by a ransom demand. Modern groups also practise double extortion: stealing data before encrypting it and threatening to publish it. Entry is usually through phishing, stolen remote-access credentials, or an unpatched internet-facing system.

Malware in general. Includes information stealers that harvest saved browser passwords and session cookies, trojans disguised as useful software (often cracked or pirated software), keyloggers and remote-access tools.

Payment and UPI fraud. Fake payment screenshots, "collect request" tricks where the victim approves a debit believing they are receiving money, QR code swaps at shop counters, and fraudulent calls posing as bank or courier staff.

Account takeover. Attackers use leaked or guessed passwords to take over e-mail, social media business pages, marketplace seller accounts or cloud storage.

Website and application attacks. Exploiting outdated content management system plug-ins, weak admin passwords or insecure code to deface a site, plant malicious scripts or steal customer data.

Insider data theft and error. Staff copying customer lists before leaving, or sending files to the wrong recipient.

Supply chain attacks. Compromise of a vendor that has access to your systems: an IT support provider's remote tool, a compromised software update, or an accounting firm whose e-mail is hacked and used to send fake invoices to its clients.

The attack chain

Security writers often describe attacks as a sequence of stages, such as the cyber kill chain: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. For a small business, a simplified version is enough:

1. Reconnaissance — the attacker learns names, e-mail formats and suppliers from websites and social media.
2. Initial access — phishing, stolen password, exposed remote desktop, or unpatched system.
3. Establishing control — installing tools, creating accounts, setting e-mail forwarding rules.
4. Expansion — moving to other systems, finding backups and financial data.
5. Impact — fraud, encryption, data theft or publication.

The value of this model is that every stage is a chance to stop the attack. MFA blocks initial access through stolen passwords; alerts on new forwarding rules detect establishing control; separated, offline backups limit impact.

3. Let us work through it

Step 1 — Describe your business profile. Sector, size, how payments are made and received, what data you hold, whether you have a website or online store, remote working, and major vendors.

Step 2 — Match threats to the profile. A business making frequent supplier payments is exposed to BEC; one with an online store is exposed to website attacks and payment fraud; one with remote staff is exposed to account takeover.

Step 3 — Identify likely entry points for each threat in your environment: which e-mail accounts, which remote-access tools, which internet-facing systems.

Step 4 — Walk the attack chain for your top two threats, noting where you could currently stop the attacker, and where you could not.

Step 5 — Record the top five threats with a one-line description of how each would hit your business. These feed directly into the risk register in the next lesson.

5. Common mistakes and how to fix them

• Assuming attackers only pursue large firms. Fix: recognise opportunistic and automated attacks that target weakness, not size.
• Focusing on exotic threats. Fix: prioritise phishing, BEC, ransomware and account takeover first.
• Trusting e-mails because they look familiar. Fix: verify payment instructions through a separate, known channel.
• Allowing pirated or unknown software. Fix: permit only licensed software from official sources.
• Ignoring vendors as a route of attack. Fix: include suppliers and IT providers in your threat thinking.
• Believing that entering a UPI PIN can receive money. Fix: remember a PIN is only needed to pay.