Ransomware Gangs Bypass CEOs to Target IT Managers
The fastest way to make companies consider ransom payments is targeting IT managers.
1Clear Target Profile Emerges
Zscaler's ThreatLabz team analyzed 351 victims from 334 organizations over one month. Data reveals ransomware groups have refined their target profile: two-thirds of victims held manager-level positions or higher. The average victim was identified as a 46-year-old Gen X employee. Three-quarters worked in accounting, finance, sales, operations, HR, or marketing departments.
2Sector Distribution
According to the research, half of ransomware victims worked in industrial or IT sectors. Attackers now conduct prior research instead of sending random emails. Zscaler notes attackers combine compromised system data with public information to map company hierarchies and identify employees who can influence ransom decisions.
3Focus on Business Privileges
Ransomware attacks now focus more on 'business privileges' than technical access. While traditional security measures protect users with admin rights, attackers target employees who approve invoices, manage budgets, or review supplier contracts. A manager account's value lies in the breadth of business access their position provides.
4Gen X in the Crosshairs
The 46-year-old average isn't coincidental. Gen X employees in their 40s and 50s typically hold established management positions. This gives attackers access to valuable systems, sensitive information, and decision-makers without targeting executives directly. They aim to accelerate ransom payments through mid-level managers.
5Multiple Access Strategy
The research found multiple compromised employees in over a dozen organizations. Attackers don't settle with single access points after breaching networks. They spread across different business functions to increase chances of reaching valuable data and people who can influence ransom payments.
6Growing Extortion Focus
Zscaler's report shows the ransomware ecosystem increasingly focuses on extortion. Ransomware attempts blocked on the company's cloud platform increased 146% over the past year. Public extortion cases rose 70%, while stolen data volume climbed 92%. By the time ransom notes arrive, attackers often already know who approves invoices and signs contracts.
7Encryption is Just the Tip
In ransomware attacks, encryption might be the only visible part to victims. But the real threat lies in attackers understanding business processes and targeting key decision-makers. Zscaler researchers emphasize encryption is just the final stage, with the real value in business access intelligence.
8Time to Rethink Security Strategies
These findings suggest traditional security approaches need reevaluation. Protection must extend beyond technical privileges to critical business process points. Particularly important is increasing cybersecurity awareness among mid-level managers and implementing specific measures against targeted attacks on these positions.