Ransomware gangs are shifting their tactics, now targeting business-privileged managers instead of CEOs to maximise their influence on ransom payments. Recent research by Zscaler’s ThreatLabz has highlighted a campaign affecting hundreds of organisations, revealing a new strategy in the ransomware landscape.
Ransomware Gangs Shift Focus to Managers
In a notable departure from previous approaches, ransomware operators are now carefully profiling and attacking managers across key business functions. Zscaler’s ThreatLabz tracked 351 individual victims at 334 organisations during a single ransomware campaign over one month. The analysis found that nearly two-thirds of those affected held manager-level titles or above, with the average victim being a 46-year-old, typically in a Gen X demographic.
The attackers are not indiscriminately targeting entire organisations or focusing solely on high-profile executives. Instead, they are zeroing in on employees in roles such as accounting and finance, sales, operations, HR and marketing. According to the research, three-quarters of victims worked in these functions, and around half were from the industrial or IT sectors.
This targeted approach indicates a significant change in attacker behaviour. Rather than blasting generic extortion emails, threat actors are conducting reconnaissance using a combination of compromised internal data and publicly available information. This allows them to map internal reporting lines and pinpoint individuals who are most likely to influence critical business decisions, particularly around financial transactions and payments.
How the Attack Campaign Unfolded
The ransomware campaign documented by Zscaler demonstrates a high level of specificity and persistence. Attackers began by gaining access to systems, often through phishing or exploiting existing vulnerabilities, and then leveraged internal data to identify managerial staff with access to sensitive business processes. Their focus was not on traditional technical privilege, such as system administrators, but on those with “business privilege”—employees authorised to approve payments, oversee budgets, manage supplier contracts, or access HR records.
Once inside, attackers moved laterally across the network, seeking multiple points of compromise. In more than a dozen cases, several employees within the same organisation were compromised, indicating that attackers were systematically working through different business functions. This increased their chances of both accessing valuable data and reaching those with authority to influence ransom payment decisions.
- Victims primarily held manager-level or higher roles
- Key targets included finance, HR, operations, sales and marketing
- Half the affected organisations were in the industrial or IT sectors
- Attackers combined internal and public data to map organisational structure
- Multiple employees were compromised within single organisations
By the time ransom demands were issued, attackers already knew who in the organisation was responsible for approving invoices, signing contracts or handling sensitive HR matters. The encryption of files was simply the final step—by then, the groundwork for extortion had already been laid.
Tactics and Trends: Why Managers Are Prime Targets
The trend towards targeting managers reflects attackers’ preference for “business privilege”. Unlike technical admin accounts, business-privileged users have access to the processes and data that directly impact a company’s ability to function. These include financial approvals, contractual agreements and employee records—assets of immediate value to attackers looking for leverage.
Zscaler’s findings show that the average victim’s age and role are no coincidence. Many managers in their forties and fifties have accumulated the trust and authority needed to access valuable systems and data, yet are not as closely monitored as executive accounts. This makes them attractive targets for ransomware operators aiming for maximum impact with minimal noise.
The campaign also revealed that ransomware groups are increasingly focused on extortion rather than simple file encryption. Zscaler reported a 146 percent increase in blocked ransomware attempts across its cloud platform over the past year. Public extortion cases rose by 70 percent, and the volume of data stolen climbed by 92 percent. This suggests that the primary goal is not just to lock up systems, but to steal data and apply pressure by threatening its release.
Implications and Protective Steps
This evolution in ransomware tactics has direct implications for organisations. Security teams can no longer concentrate solely on protecting admin accounts and executive leadership. Instead, there must be a renewed focus on those with business privilege—managers and staff whose access to payment systems, contracts and sensitive records puts them in the crosshairs of sophisticated attackers.
- Review and strengthen identity and access controls for business-privileged users
- Implement robust email security to prevent phishing and social engineering
- Ensure tighter approvals and monitoring of payment and contract processes
Organisations should act quickly to map out their own business-privileged users, assess the risks associated with their access, and apply necessary controls to limit exposure to these evolving ransomware threats.
Originally reported by theregister.com.
