In 2024, several trends have converged to create a perfect storm for SOHO and SMB cybersecurity:

• Infostealers on the Rise: Infostealers have become a major threat. These malicious programs steal sensitive data like passwords, cookies, and autofill information from browsers, as well as cryptocurrency wallet details and session data from messaging apps . They often spread through a “spray-and-pray” approach, targeting personal devices, which are then used to access corporate networks . Over 70% of devices infected by infostealers are personal devices, not corporate ones . This is particularly concerning for SMBs with Bring Your Own Device (BYOD) policies, where personal devices are used to access work resources.
• Ransomware‘s Continued Impact: Ransomware remains a significant threat. While large groups like LockBit and ALPHV have seen disruptions, smaller groups like RansomHub, Akira, and Play have emerged, creating a more fragmented landscape. The healthcare sector was hit particularly hard, as attackers increasingly targeted healthcare entities for data extortion. However, with ransomware-as-a-service (RaaS) operations becoming commoditized, more actors are able to launch their own attacks .
• Edge Device Exploitation: SOHO routers, firewalls, and VPN appliances are attractive targets due to their lack of dedicated security solutions. Cybercriminals and state-sponsored actors have increasingly exploited these devices for initial access to networks . Vulnerabilities in devices like Ubiquiti routers and cameras were widely exploited, allowing attackers to gain unauthorized access. The exploitation of these devices also often leads to setting up an anonymization infrastructure known as Operational Relay Boxes (ORBs).
• Cloud Complexity: Many SMBs rely on cloud services, and the complexity of cloud administration adds another layer of vulnerability . Misconfigurations in cloud environments expose resources online, and make them easily penetrable. Even large tech companies like Microsoft have experienced breaches due to misconfigured cloud environments. The absence of Multi-Factor Authentication (MFA) for cloud services is a major issue.