Black Kite Report: 75% of Ransomware Attacks Hit Mid-Market Firms — A Defensive Playbook for Manufacturers and Mid-Sized Enterprises

New analysis from Black Kite confirms what many of us in incident response have been seeing in the field for the past 18 months: roughly three-quarters of encryption-based cyber incidents now target mid-market organizations, and manufacturers are the single most likely victims. This is not a statistical curiosity — it is a deliberate strategic shift by ransomware operators, and if your organization sits in the mid-market band, you are no longer "too small to be a target." You are the target.

For defenders, this report should land as an alarm, not a footnote. Mid-market firms typically carry enough revenue and cyber insurance to make a ransom payment viable, but lack the 24/7 SOC coverage, segmentation maturity, and tested incident response plans of the Fortune 500. Ransomware affiliates have figured this out. They have industrialized their attack chains — initial access brokers, RaaS kits, double-extortion playbooks — and aimed them squarely at organizations with 200 to 5,000 employees, flat networks, and production environments that cannot tolerate downtime.

Manufacturers are disproportionately hit for a simple reason: operational downtime is existential. When a plant floor stops, the cost of negotiation leverage goes up by the hour. Attackers know that a mid-market manufacturer facing halted production lines, unpatched Windows servers, and IT/OT convergence gaps will pay faster and more often than a well-defended enterprise. This post breaks down why the mid-market is exposed, how these attacks actually unfold, and — most importantly — what your SOC and IT teams can do this week to detect and stop encryption-based intrusions before detonation.

Why Mid-Market Manufacturers Are the Sweet Spot

Black Kite's findings align with what ransomware economics predict. Attackers optimize for the ratio of payout likelihood to operational effort:

• Sufficient revenue and insurance coverage. Mid-market firms can typically pay six- and seven-figure ransoms, often backed by cyber insurance policies that attackers explicitly search for during reconnaissance.
• Immature security operations. Most mid-market organizations have no in-house 24/7 monitoring. Alerts generated at 2:00 AM on a Saturday — when most ransomware detonates — sit unread until Monday morning.
• Flat or lightly segmented networks. IT and OT environments are frequently interconnected. Domain admin credentials harvested from one compromised workstation often unlock the entire estate, including historian servers, MES systems, and backup infrastructure.
• Legacy and unpatchable systems. Manufacturing environments run long-lifecycle assets: Windows Server 2012/2016 domain controllers, embedded HMIs, and line-of-business applications that cannot be taken offline for patching without stopping production.
• Third-party and supply-chain exposure. Mid-market firms depend on managed service providers, ERP vendors, and logistics partners — each a potential initial access vector.

The result is a target population that is profitable to hit and cheap to breach. Ransomware groups do not need zero-days for this segment; commodity initial access (phishing, exposed RDP, stolen VPN credentials, infostealer logs) is sufficient.

Technical Analysis: How These Attacks Actually Unfold

While Black Kite's report is statistical rather than tied to a single vulnerability, the tradecraft behind mid-market encryption incidents is remarkably consistent. Across engagements I've led, the attack chain almost always follows this shape:

Stage 1 — Initial Access

Phishing with malicious attachments or links, exploitation of internet-facing remote access (VPN concentrators, RDP gateways, remote management tools), or purchase of credentials harvested by infostealer malware (Lumma, RedLine, Vidar families dominate the access-broker market in 2025–2026).

Stage 2 — Persistence and Credential Theft

Attackers deploy Cobalt Strike or legitimate RMM tooling (AnyDesk, ScreenConnect, Atera, Splashtop) for persistence. LSASS memory is dumped with tools like rundll32 comsvcs.dll MiniDump or direct procdump execution to harvest credentials. In manufacturing environments, domain admin credentials are frequently found in plaintext on shop-floor terminals or in unattended install scripts.

Stage 3 — Discovery and Lateral Movement

BloodHound/SharpHound mapping, nltest, net group "Domain Admins" /domain, and SMB-based lateral movement via PsExec, WMI, or RDP. Backup infrastructure (Veeam, Commvault, Windows Server Backup) is enumerated and targeted first — destroying recovery capability precedes encryption.

Stage 4 — Pre-Encryption Sabotage

Immediately before detonation, operators execute the classic pre-encryption sequence: shadow copy deletion via vssadmin delete shadows /all /quiet or wmic shadowcopy delete, boot recovery tampering via bcdedit, and killing of backup, database, and security agent services. This sequence is one of the highest-fidelity ransomware indicators available to defenders — it has almost no legitimate use in bulk.

Stage 5 — Mass Encryption and Extortion

Encryption is pushed en masse, often via Group Policy or PsExec from a domain controller, during off-hours. Data exfiltration (to MEGA, Rclone-backed cloud storage, or attacker infrastructure) typically completes before encryption so the double-extortion threat is armed.

Exploitation Status

This is not a theoretical threat. Encryption-based incidents against mid-market firms are confirmed, ongoing, and — per Black Kite's data — represent the majority of observed ransomware activity. Multiple RaaS ecosystems actively recruit affiliates focused on this segment, and CISA's #StopRansomware guidance continues to catalog actively exploited vulnerabilities used in these chains.

Detection & Response

The detections below target the highest-signal behaviors in the mid-market ransomware kill chain: shadow copy destruction, boot recovery tampering, mass file encryption patterns, and unauthorized RMM tooling. These are tuned for low noise — a veteran analyst should be able to run them in production without drowning in false positives.

Sigma Rules

---
title: Shadow Copy Deletion via Command Line
title_note: Pre-encryption ransomware behavior
id: 4b8f2e61-7c3a-4d92-9f1e-8a6c5b2d4e7f
status: experimental
description: Detects deletion of Volume Shadow Copies via vssadmin, wmic, or PowerShell — a hallmark pre-encryption ransomware behavior with virtually no legitimate bulk use.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.infosecurity-magazine.com/news/threequarters-ransomware-attacks/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith:
      - '\wmic.exe'
      - '\wmiprvse.exe'
    CommandLine|contains: 'shadowcopy'
    CommandLine|contains|all:
      - 'delete'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Get-CimInstance Win32_ShadowCopy'
      - 'Remove-WmiObject'
  condition: 1 of selection_*
falsepositives:
  - Rare legitimate storage reclamation by backup administrators — verify change tickets
level: critical
---
title: Boot Configuration Tampering via bcdedit
title_note: Ransomware recovery inhibition
id: 9e2d5a74-1f6b-4c83-8a2d-5c7f9e1b3d6a
status: experimental
description: Detects bcdedit being used to disable recovery mode or ignore boot failures, inhibiting victim recovery — observed consistently in ransomware pre-encryption staging.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.infosecurity-magazine.com/news/threequarters-ransomware-attacks/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'recoveryenabled 0'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection
falsepositives:
  - Extremely rare in legitimate administration — investigate any hit
level: critical
---
title: Unauthorized Remote Management Tool Execution
title_note: Common ransomware affiliate persistence vector
id: 6c1e8b39-4a7d-4f25-b9e3-2d8a6c4f1e9b
status: experimental
description: Detects execution of remote access tooling frequently abused by ransomware affiliates for hands-on-keyboard access in mid-market environments where such tools are not part of the approved IT stack.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://www.infosecurity-magazine.com/news/threequarters-ransomware-attacks/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\anydesk.exe'
      - '\screenconnect.client.exe'
      - '\atera_agent.exe'
      - '\splashtop.exe'
      - '\sr_manager.exe'
      - '\teamviewer.exe'
      - '\rustdesk.exe'
      - '\netop.exe'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\ApprovedIT\'
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate RMM deployed by MSPs — build an approved-path exclusion for your environment before enabling
level: high

KQL — Microsoft Sentinel / Defender

This hunt query correlates the pre-encryption sabotage sequence (shadow copy deletion, bcdedit tampering, backup service termination) with suspicious mass file rename activity — the detonation signature. Run it as an hourly scheduled analytic rule with a 7-day lookback for hunting.

// Hunt: Ransomware pre-encryption sabotage + mass rename correlation
let Lookback = 7d;
let SabotageCmds = dynamic(["vssadmin", "shadowcopy", "bcdedit", "wbadmin delete", "recoveryenabled no", "ignoreallfailures"]);
let Sabotage =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe", "powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any (SabotageCmds)
    | project SabotageTime=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DeviceId;
let MassRename =
    DeviceFileEvents
    | where Timestamp > ago(1d)
    | where ActionType == "FileRenamed"
    | summarize RenameCount = count(), DistinctExtensions = dcount(parse_path(FolderPath).Extension)
      by DeviceName, bin(Timestamp, 5m)
    | where RenameCount > 200;
Sabotage
| join kind=leftouter (MassRename) on DeviceName
| project DeviceName, SabotageTime, AccountName, FileName, ProcessCommandLine, RenameCount, Timestamp
| order by SabotageTime desc

For environments ingesting syslog from Linux file servers and network gear into Sentinel (common in manufacturing where NAS/storage arrays are the encryption target):

// Hunt: SMB/ransomware-style mass modification signals from syslog-ingested infrastructure
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("vssadmin", "shadowcopy delete", "bcdedit", "esxcli", "vim-cmd vmsvc")
   or (Facility == "auth" and SyslogMessage has "Failed password" and Computer !in ("known-jump-host-01"))
| summarize EventCount = count(), SampleMessages = make_set(SyslogMessage, 5)
  by Computer, HostIP, bin(TimeGenerated, 15m)
| where EventCount > 10
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts endpoints for evidence of shadow copy tampering, suspicious RMM execution, and recently dropped ransom notes — useful for scoping during an active mid-market engagement where you need rapid fleet-wide answers.

-- Ransomware staging hunt: shadow copies, RMM tools, ransom notes
LET shadow_status = SELECT {
   SELECT Name, CommandLine, Username, CreateTime
   FROM pslist()
   WHERE CommandLine =~ '(?i)vssadmin.*delete|shadowcopy.*delete|bcdedit.*recoveryenabled'
} AS SabotageProcesses

LET rmm = SELECT Name, Pid, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ '(?i)anydesk|screenconnect|atera|splashtop|rustdesk|teamviewer'
  AND NOT Exe =~ '(?i)Program Files\\\\ApprovedIT'

LET ransom_notes = SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/Desktop/*{README,RESTORE,DECRYPT,HOW_TO}*.txt',
          accessor='ntfs')
WHERE Mtime > now() - 86400 * 7

SELECT * FROM chain(
   a=shadow_status, b={ SELECT * FROM rmm }, c={ SELECT * FROM ransom_notes })

PowerShell — Verify and Harden Recovery Posture

Run this on domain controllers, file servers, and backup servers to verify shadow copy integrity, confirm boot recovery is enabled, audit for unauthorized RMM tools, and confirm protected folders / backup service state. Schedule it weekly via your RMM or as a Defender for Endpoint live-response script.

# Security Arsenal - Mid-Market Ransomware Recovery Posture Audit
# Run as Administrator on servers/workstations. Outputs findings to console and CSV.

$report = @()

# 1. Verify Volume Shadow Copies exist and are healthy
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report += [pscustomobject]@{Check='ShadowCopies'; Status='FAIL'; Detail='No shadow copies present - verify VSS configuration'}
} else {
    $report += [pscustomobject]@{Check='ShadowCopies'; Status='PASS'; Detail="$($shadows.Count) shadow copies present, newest: $($shadows | Sort-Object InstallDate -Descending | Select-Object -First 1 -ExpandProperty InstallDate)"}
}

# 2. Verify boot recovery is enabled (ransomware frequently disables it)
$bcd = bcdedit /enum {current} 2>$null | Out-String
if ($bcd -match 'recoveryenabled\s+No' -or $bcd -match 'ignoreallfailures') {
    $report += [pscustomobject]@{Check='BootRecovery'; Status='FAIL'; Detail='Recovery disabled or ignoreallfailures set - possible ransomware tampering'}
} else {
    $report += [pscustomobject]@{Check='BootRecovery'; Status='PASS'; Detail='Recovery enabled'}
}

# 3. Audit for unauthorized remote access tools
$unauthorizedRMM = @('anydesk','screenconnect','atera','splashtop','rustdesk','teamviewer','netop')
$found = Get-Process -ErrorAction SilentlyContinue | Where-Object { $p = $_.ProcessName; $unauthorizedRMM | Where-Object { $p -match $_ } }
if ($found) {
    $report += [pscustomobject]@{Check='RMM Tools'; Status='FAIL'; Detail="Unauthorized RMM running: $($found.ProcessName -join ', ')"}
} else {
    $report += [pscustomobject]@{Check='RMM Tools'; Status='PASS'; Detail='No unauthorized RMM processes detected'}
}

# 4. Confirm VSS and backup services are not disabled
foreach ($svc in 'VSS','swprv','wbengine') {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s -and $s.StartType -eq 'Disabled') {
        $report += [pscustomobject]@{Check="Service:$svc"; Status='FAIL'; Detail='Service disabled - investigate'}
    }
}

# 5. Check for Controlled Folder Access (anti-ransomware) on supported OS
$cfa = Get-MpPreference -ErrorAction SilentlyContinue
if ($cfa -and $cfa.EnableControlledFolderAccess -eq 1) {
    $report += [pscustomobject]@{Check='ControlledFolderAccess'; Status='PASS'; Detail='CFA enabled'}
} else {
    $report += [pscustomobject]@{Check='ControlledFolderAccess'; Status='WARN'; Detail='Consider enabling CFA: Set-MpPreference -EnableControlledFolderAccess Enabled'}
}

# 6. Re-enable recovery if tampered (uncomment to remediate automatically)
# bcdedit /set {current} recoveryenabled yes
# bcdedit /set {current} bootstatuspolicy displayallfailures

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:ProgramData\RansomwarePostureAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation -Append

Remediation: What Mid-Market Defenders Must Do Now

There is no single patch for this problem — the fix is architectural and operational. Prioritized for the mid-market reality of lean teams and constrained budgets:

1. Deploy 24/7 monitoring — in-house or via MDR. The single biggest gap Black Kite's data implies is the absence of around-the-clock detection. Ransomware detonates off-hours precisely because mid-market SOCs are dark. If you cannot staff a SOC, contract one. The Sigma and KQL content above should be live in your SIEM this week.
2. Protect and isolate backups. Immutable, offline, or logically air-gapped backups with credentials separate from Active Directory. Test restoration quarterly — a backup that has never been restored is a hypothesis, not a control. Attackers target backup infrastructure first; treat Veeam/Commvault servers as Tier 0 assets.
3. Kill the commodity initial access vectors. Enforce phishing-resistant MFA (FIDO2) on VPN, remote access, and email. Block or tightly control unauthorized RMM tools via application allowlisting. Hunt your estate for infostealer-exposed credentials on darknet markets and force resets.
4. Segment IT from OT — for real. Manufacturing networks need deny-by-default rules between production VLANs and corporate IT, with brokered access through hardened jump hosts. A compromised accounting workstation must never be able to reach an HMI or historian.
5. Harden against pre-encryption sabotage. Restrict vssadmin, bcdedit, and wbadmin execution to a named admin group via WDAC or AppLocker. Alert on every execution (rules above). Enable Controlled Folder Access and tamper protection.
6. Patch internet-facing infrastructure on a 72-hour SLA for KEV-listed vulnerabilities. Subscribe to CISA's Known Exploited Vulnerabilities catalog and treat additions as emergencies — these are the exact edge-device flaws access brokers monetize against mid-market targets.
7. Build and rehearse an IR plan. Tabletop a ransomware scenario that assumes: no domain controllers, no backups for 48 hours, production lines down, and a live extortion timer. Know who has authority to decide on payment, who your counsel and IR retainer are, and what your cyber insurance carrier requires before an incident.
8. Review your third-party exposure. Mid-market breaches increasingly arrive through MSPs and software vendors. Require MFA evidence, incident notification SLAs, and least-privilege access from every external party with connectivity into your environment.

The takeaway from Black Kite's report is blunt: the ransomware economy has identified its most profitable prey, and it is you. The good news is that the attack chains are well understood, the pre-encryption behaviors are noisy and detectable, and the defensive investments that matter most — monitoring, segmentation, backup integrity, MFA — are achievable at mid-market scale. The organizations that survive these incidents are the ones that detected staging behavior in hours, not the ones that found ransom notes on Monday morning.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub