Ransomware Attacks Now Target IT Managers Instead of CEOs
According to Zscaler's report, ransomware crews are increasingly focusing on IT managers rather than CEOs.
1New Target in Ransomware Attacks: IT Managers
Zscaler's ThreatLabz team tracked 351 victims across 334 organizations over a month. Ransomware crews are now targeting IT managers instead of CEOs. Two-thirds of the victims hold manager-level titles or higher. The average victim is a 46-year-old Gen X employee, mostly working in accounting, finance, sales, operations, HR, or marketing departments.
2The Rise of Targeted Attacks
Attackers are now conducting research beforehand instead of sending random emails. According to Zscaler, attackers combine information from compromised systems with publicly available data to map reporting lines and identify employees most likely to influence the company's response. This shows that ransomware attacks are being carried out in a targeted manner.
3The Importance of Business Access and Authority
Attackers focus on 'business privilege' rather than technical privileges. Traditionally, security teams have focused on protecting users with administrative rights. However, attackers target employees who approve invoices, manage budgets, or review supplier contracts as part of their daily jobs. These positions provide valuable access for attackers.
4Why Gen X Employees Are Targeted
The fact that most victims are in their 40s and 50s is no coincidence. According to Zscaler, employees in this age group often hold established management positions. This makes it easier for attackers to access valuable systems, sensitive information, and decision-makers. Additionally, cases where multiple employees were compromised were also observed.
5The Shift in the Ransomware Ecosystem
The ransomware ecosystem is now focused not only on encryption but also on extortion. Zscaler states that ransomware attempts blocked on its cloud platform increased by 146% over the past year. Public extortion cases rose by 70%, and the volume of data stolen from victims climbed by 92%. This shows that attackers are focusing on extortion before encryption.
6Targeting Internal Business Functions
Once inside a network, attackers do not stay at a single point. According to Zscaler, attackers infiltrate different business functions to increase their chances of accessing valuable data and individuals who can influence ransom payments. This strategy allows attackers to spread more widely within the company.
7The Impact of Ransomware Attacks
Ransomware attacks can have serious financial and operational consequences for companies. According to Zscaler's report, attackers learn who approves invoices, signs contracts, and manages HR before making a ransom demand. This information is used to accelerate ransom payments.
8The Importance of Security Measures
With the increase in ransomware attacks, companies need to review their security measures. Zscaler notes that attackers carry out targeted attacks, which may render traditional security measures insufficient. Companies should take measures such as employee training and updating security protocols.