# Ransomware Attacks Now Target IT Managers Instead of CEOs According to Zscaler's report, ransomware crews are increasingly focusing on IT managers rather than CEOs. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-08-09 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/41350f05-29ff-49ff-a17e-d2ba2d7069e6 ## New Target in Ransomware Attacks: IT Managers Zscaler's ThreatLabz team tracked 351 victims across 334 organizations over a month. Ransomware crews are now targeting IT managers instead of CEOs. Two-thirds of the victims hold manager-level titles or higher. The average victim is a 46-year-old Gen X employee, mostly working in accounting, finance, sales, operations, HR, or marketing departments. ## The Rise of Targeted Attacks Attackers are now conducting research beforehand instead of sending random emails. According to Zscaler, attackers combine information from compromised systems with publicly available data to map reporting lines and identify employees most likely to influence the company's response. This shows that ransomware attacks are being carried out in a targeted manner. ## The Importance of Business Access and Authority Attackers focus on 'business privilege' rather than technical privileges. Traditionally, security teams have focused on protecting users with administrative rights. However, attackers target employees who approve invoices, manage budgets, or review supplier contracts as part of their daily jobs. These positions provide valuable access for attackers. ## Why Gen X Employees Are Targeted The fact that most victims are in their 40s and 50s is no coincidence. According to Zscaler, employees in this age group often hold established management positions. This makes it easier for attackers to access valuable systems, sensitive information, and decision-makers. Additionally, cases where multiple employees were compromised were also observed. ## The Shift in the Ransomware Ecosystem The ransomware ecosystem is now focused not only on encryption but also on extortion. Zscaler states that ransomware attempts blocked on its cloud platform increased by 146% over the past year. Public extortion cases rose by 70%, and the volume of data stolen from victims climbed by 92%. This shows that attackers are focusing on extortion before encryption. ## Targeting Internal Business Functions Once inside a network, attackers do not stay at a single point. According to Zscaler, attackers infiltrate different business functions to increase their chances of accessing valuable data and individuals who can influence ransom payments. This strategy allows attackers to spread more widely within the company. ## The Impact of Ransomware Attacks Ransomware attacks can have serious financial and operational consequences for companies. According to Zscaler's report, attackers learn who approves invoices, signs contracts, and manages HR before making a ransom demand. This information is used to accelerate ransom payments. ## The Importance of Security Measures With the increase in ransomware attacks, companies need to review their security measures. Zscaler notes that attackers carry out targeted attacks, which may render traditional security measures insufficient. Companies should take measures such as employee training and updating security protocols. ## Sources covering this story - https://www.theregister.com/security/2026/08/09/ransomware-gangs-skip-the-ceo-head-straight-for-the-40-something-it-manager/5284499 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._