Dark web access brokers increasingly target SMBs

Small and medium-sized businesses accounted for more than half of analyzed dark web posts offering access to compromised corporate systems in the first four months of 2026, according to cybersecurity firm Kaspersky.

Kaspersky Digital Footprint Intelligence experts examined hundreds of posts published by initial access brokers on dark web markets from January to April 2025 and during the same period in 2026.

The findings showed that initial access offers involving small and medium-sized organizations represented 60% of all analyzed posts in 2026.

Posts involving allegedly compromised small organizations accounted for the largest share at 40%.

Offers involving medium-sized organizations made up another 20%.

The combined figures exceeded the shares of posts involving large businesses and nonprofit organizations, highlighting the exposure of smaller companies to financially motivated cyberattacks.

Initial access brokers obtain and sell entry points into allegedly compromised corporate networks through dark web forums.

Their listings may include the location, industry and revenue of a targeted company, as well as the type of system access being offered.

Buyers may use the access to deploy ransomware, steal confidential business information or carry out other fraudulent activities.

“Despite the fact that posts concerning small-sized companies prevail, threat actors may target medium-sized businesses as they generate higher revenue than small businesses while they may have lower level of protection against cyberthreats than large ones. Thus, the common belief that small- and medium-sized enterprises are uninteresting to attackers is a misconception. Companies of any size need to understand the cyberthreat landscape, adhere to cybersecurity policies, use appropriate cybersecurity solutions, and continuously improve employees’ awareness”, says Ekaterina Beloborodova, Kaspersky Digital Footprint Intelligence Analyst.

Kaspersky said businesses should adopt cybersecurity tools that match their budget, size and industry requirements, with particular attention to scalability and ease of integration.

The company recommended Kaspersky Small Office Security Premium for microbusinesses seeking protection against advanced threats and access to employee security awareness training.

It also recommended Kaspersky Next Optimum for small and medium-sized enterprises with more mature information technology capabilities.

The platform offers real-time protection, threat visibility, investigation tools and endpoint detection and response and extended detection and response capabilities.

Businesses without dedicated cybersecurity personnel or the capacity for round-the-clock monitoring may also consider managed security services, Kaspersky said.

Kaspersky Managed Detection and Response provides 24/7 support across the incident management cycle, from threat detection to continuous protection and remediation.

The company also advised businesses to use specialized services such as Kaspersky Digital Footprint Intelligence to monitor the surface, deep and dark webs for leaked credentials, exposed corporate data and fraudulent websites impersonating legitimate companies.

Small and medium-sized companies with limited cybersecurity budgets may work with a managed security service provider to access digital risk protection services through subscription-based arrangements.

Kaspersky also recommended establishing clear guidelines for the use of external services and resources.

Businesses should define access rules for corporate resources, including email accounts, shared folders and online documents.

Companies should also regularly back up critical data to preserve corporate information during cybersecurity incidents and other emergencies.

Founded in 1997, Kaspersky is a global cybersecurity and digital privacy company serving consumers, businesses, critical infrastructure operators and governments.

The company said its technologies have protected more than 1 billion devices worldwide.

Kaspersky said it is trusted by millions of individual users and nearly 200,000 organizations globally.