{"id":8200,"date":"2025-05-02T17:40:31","date_gmt":"2025-05-02T15:40:31","guid":{"rendered":"https:\/\/eu.it-cyberwall.com\/blog\/2025\/05\/02\/who-attacks-smes-and-why\/"},"modified":"2026-10-19T18:12:26","modified_gmt":"2026-10-19T16:12:26","slug":"les-attackers-daujourdhui-qui-sont-ils-et-quels-sont-leurs-objectifs","status":"publish","type":"post","link":"https:\/\/eu.it-cyberwall.com\/en\/blog\/2025\/05\/02\/les-attackers-daujourdhui-qui-sont-ils-et-quels-sont-leurs-objectifs\/","title":{"rendered":"Who attacks SMEs, and why?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"8200\" class=\"elementor elementor-8200 elementor-6938\" data-elementor-settings=\"{&quot;ha_cmc_init_switcher&quot;:&quot;no&quot;}\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e487a29 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e487a29\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6ee4e58\" data-id=\"6ee4e58\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b4048eb elementor-widget elementor-widget-html\" data-id=\"b4048eb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t\t<style>.itcw-g{max-width:900px;margin:0 auto;font-size:17px;line-height:1.65;color:#2b2f3a}.itcw-g h2{margin-top:10px}.itcw-g .tw{overflow-x:auto;margin:18px 0}.itcw-g table{width:100%;border-collapse:collapse;font-size:15px;min-width:640px}.itcw-g th,.itcw-g td{border:1px solid #e3e6ee;padding:10px 12px;vertical-align:top;text-align:left}.itcw-g thead th{background:#0E0129;color:#fff}.itcw-g tbody th{background:#F6F7FA;font-weight:600}.itcw-g .box{background:#F6F7FA;border-left:4px solid #DE3241;padding:16px 20px;border-radius:6px;margin:18px 0}.itcw-g .box.ok{border-left-color:#2C9703}.itcw-g sup a{text-decoration:none;font-weight:600}.itcw-g ol.src li{margin-bottom:8px;font-size:15px;word-break:break-word}.itcw-g .note{font-size:14px;color:#6b7080}.itcw-g .toc a{display:inline-block;margin:4px 10px 4px 0}<\/style><style>.itcw-post{max-width:none}.itcw-post .lead{font-size:19px;font-weight:600;color:#0e0129}.itcw-post h2{font-size:24px;margin:28px 0 12px}.itcw-post ul,.itcw-post ol{padding-left:22px}.itcw-post li{margin-bottom:8px}.itcw-post .itcw-wdb{text-align:left!important;margin-top:18px!important}<\/style>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-64e8952 elementor-widget elementor-widget-text-editor\" data-id=\"64e8952\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g itcw-post\"><p class=\"lead\">SMEs are mainly targeted by criminal groups who want money: either by locking or stealing their data to sell it back, or by tricking them into making a bank transfer. It is almost never personal: the attacker is looking for an open door, not for your business in particular.<\/p><h2>What has changed since 2025<\/h2><p>Ransomware has become a <strong>service<\/strong>: one group develops the tool and the infrastructure, then rents them out to \u201caffiliates\u201d who carry out the attacks and share the ransom. Others resell access that has already been stolen (email credentials, VPN access) to anyone willing to buy it. So the attacker no longer needs to be skilled: paying is enough.<\/p><p>In its threat overview published on 11 March 2026, ANSSI notes that data encryption is declining in favour of <strong>data theft alone<\/strong>, followed by blackmail threatening publication, and that internet-facing equipment (firewalls, VPNs) is exploited very quickly after a vulnerability is published.<\/p><p>Alongside this, <strong>bank transfer fraud<\/strong> requires no technical skill at all: a fake supplier sends new bank details, or a fake executive demands an urgent payment.<\/p><p>State-sponsored attacks do exist, but they mainly target public bodies and large corporations: they are not an SME\u2019s main risk.<\/p><h2>To check this week<\/h2><div class='box ok'><ul><li>Do email and remote access (VPN, remote desktop) require a second factor, in addition to the password?<\/li><li>Have the firewall and the VPN gateway received their latest security update?<\/li><li>Is a change to a supplier\u2019s bank details always confirmed by calling the number you already have?<\/li><li>Do you know who to call, and what not to touch, if a screen displays a ransom demand?<\/li><\/ul><\/div><div class=\"box\"><strong>Further reading:<\/strong> <a href=\"https:\/\/eu.it-cyberwall.com\/en\/guides\/rancongiciel-premieres-heures\/\">Ransomware: what to do in the first hours<\/a><\/div><p>Questions about your situation? <a href=\"https:\/\/eu.it-cyberwall.com\/en\/contact\/?mf-besoin=cybersecurite#formulaire\">Describe my needs<\/a><\/p><p class=\"note\">Sources consulted on 19 October 2026: <a href=\"https:\/\/cert.cyber.gouv.fr\/cti\/CERTFR-2026-CTI-002\" target=\"_blank\" rel=\"noopener\">ANSSI \u2013 Panorama de la cybermenace 2025, published on 11 March 2026<\/a>; <a href=\"https:\/\/www.cybermalveillance.gouv.fr\/tous-nos-contenus\/fiches-reflexes\/escroquerie-faux-ordres-virement-fovi\" target=\"_blank\" rel=\"noopener\">Cybermalveillance.gouv.fr \u2013 Fraude au faux ordre de virement (FOVI)<\/a>.<br \/>Article written by IT CyberWall.<\/p><p class=\"itcw-wdb\" style=\"text-align:center;font-size:15px;color:#4b5563;margin:0\">Backup and restoration are operated by <a href=\"https:\/\/www.wedoback.com\/guides\/que-faire-si\/un-ransomware-vient-de-se-declencher\/\" target=\"_blank\" rel=\"noopener\">WeDoBack<\/a>.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>SMEs are mainly targeted by criminal groups who want money: either by locking or stealing their data to sell it back, or by tricking them into making a bank transfer. It is almost never personal: the attacker is looking for an open door, not for your business in particular.<\/p>\n","protected":false},"author":1,"featured_media":3623,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"Who attacks European SMEs, and why? | IT CyberWall","_seopress_titles_desc":"Ransomware as a service, stolen access resold, transfer fraud: who targets SMEs in Europe in 2026, and four checks to make this week in your business.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"cyberattack on smes europe,ransomware as a service,bank transfer fraud,sme it security","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"page_builder":"","footnotes":""},"categories":[72],"tags":[],"class_list":["post-8200","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-securite"],"_links":{"self":[{"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/posts\/8200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/comments?post=8200"}],"version-history":[{"count":1,"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/posts\/8200\/revisions"}],"predecessor-version":[{"id":8201,"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/posts\/8200\/revisions\/8201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/media\/3623"}],"wp:attachment":[{"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/media?parent=8200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/categories?post=8200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/tags?post=8200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}