Ransomware attackers are increasingly targeting managers and senior employees rather than focusing only on technical administrators.
New research from Zscaler ThreatLabz found that 62% of victims in a ransomware-linked campaign held manager-level positions or higher.
The findings show that attackers do not always need to compromise an IT administrator to damage a company.
Employees with business authority, access to sensitive documents, financial systems, vendors, customers, and internal communication channels can provide an equally valuable entry point.
ThreatLabz tracked 351 victims across 334 organizations during a one-month period.
The campaign was linked to a ransomware group known for gaining initial access, stealing corporate data, and encrypting selected systems to increase pressure on victims.
More than a dozen organizations had multiple employees compromised, showing that attackers may not stop after gaining access to one account.
Instead, they can use a first victim to identify more targets, steal additional data, and move deeper into the corporate environment.
Ransomware Targets Senior Management
Nearly two-thirds of victims held managerial titles or more senior roles. These employees may not have direct administrator privileges, but they often hold what researchers describe as business privilege.
Managers can approve invoices, manage budgets, communicate with suppliers, access customer records, review contracts, oversee business operations, and coordinate with multiple departments.
A compromised manager account can therefore provide ransomware operators with a broad view of the organization and several paths for fraud, data theft, or further compromise.
The research also found that around 75% of victims worked in five major business functions: accounting and finance, sales, operations, human resources, and marketing.
Accounting and finance employees accounted for 17.7% of victims. These roles may have access to invoices, payment approvals, vendor information, banking data, and financial records.
Attackers could use this access to disrupt payments, identify high-value suppliers, or launch convincing business email compromise attempts.
Sales employees made up 17.4% of victims. They often handle customer accounts, pricing information, contracts, sales forecasts, and ongoing deals.
Stolen data from these systems can harm customer relationships and give criminals material for extortion. Operations workers represented 16.8% of victims.
Their accounts may provide visibility into suppliers, production schedules, logistics, internal processes, and business-critical systems. This information can help attackers understand where disruption would create the most pressure.
Generation X employees were the largest victim group, representing 44% of the total. Victims ranged from 23 to 70 years old, with an average age of 46.
The trend is likely linked to career seniority, as many employees in this age group hold management positions with wider access and decision-making authority, Zscaler said.
Industrials and information technology were the most affected sectors, accounting for 35.5% and 14.6% of victims respectively.
For industrial firms, compromised employees could expose manufacturing, distribution, and logistics systems. In IT companies, attackers may gain access to intellectual property, service platforms, and sensitive customer information.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
