Ransomware attacks are often measured by their final impact: encrypted systems, stolen data, operational disruption, and multimillion-dollar ransom demands.
However, the employees compromised during the initial stages of an attack receive far less attention.
New research from Zscaler ThreatLabz suggests that ransomware operators are increasingly targeting employees whose business authority and access can provide valuable pathways into an organization.
- Key takeaways of Zscaler’s ransomware findings
- Ransomware attackers increasingly target managers and business leaders
- Why ransomware attackers target managers with privileged business access
- Business functions most targeted by ransomware attacks
- Why ransomware attackers target industrial and technology companies
- How organizations can reside ransomware risk
Key takeaways of Zscaler’s ransomware findings
- 62% of victims held manager-level positions or higher
- 75% of victims worked in finance, sales, operations, HR, or marketing
- About 50% of victims worked in the industrial or IT sectors
- 44% of victims were Generation X, with an average age of 46
Ransomware attackers increasingly target managers and business leaders
ThreatLabz analyzed a ransomware campaign associated with a group known for obtaining initial access, stealing significant amounts of corporate data, and selectively encrypting critical systems.
Over a one-month period, researchers identified 351 victims across 334 organizations.
The findings indicate that managerial authority, access to financial processes, and cross-functional business relationships can make employees more attractive targets.
Why ransomware attackers target managers with privileged business access
Among the victims identified, 62% held manager-level positions or higher. This finding highlights an important distinction between technical privilege and business privilege.
Traditional security programs often focus on users with elevated technical permissions, but managers may hold equally valuable business privileges.
Depending on their responsibilities, they may approve payments, oversee budgets, communicate with vendors, review contracts, access confidential information, or coordinate activities across departments.
Compromising these accounts could therefore allow ransomware operators to gather intelligence, access sensitive information, impersonate trusted employees, or expand their reach within the organization.
The research also found that Generation X represented 44% of victims, with victims averaging 46 years of age.
Rather than indicating that age itself is a primary risk factor, the finding may reflect career seniority.
Many Generation X employees currently occupy established managerial and leadership positions that provide the organizational access attackers seek.
Business functions most targeted by ransomware attacks
Approximately 75% of victims worked in accounting and finance, sales, operations, human resources, or marketing.
Accounting and finance represented 17.7% of victims, while sales accounted for 17.4% and operations for 16.8%.
These functions routinely handle information and processes that could be valuable during a ransomware attack.
For example, accounting personnel may access invoices, payment information, banking details, approvals, and vendor records.
Sales managers may work with customer accounts, contracts, pricing, and revenue forecasts.
Operations employees often coordinate suppliers, internal teams, and essential business processes.
The findings demonstrate why an employee does not need administrator credentials to create significant exposure.
Ordinary business access can provide a route to sensitive information, enterprise applications, financial processes, and trusted internal communications.
Why ransomware attackers target industrial and technology companies
About half of the identified victims worked in two sectors: industrials accounted for 35.5%, while information technology represented 14.6%.
Compromised employees in industrial organizations could potentially provide access to systems supporting manufacturing, logistics, or distribution.
Within technology companies, employee accounts may expose intellectual property or platforms supporting digital products and services.
These environments are valuable ransomware targets because disrupting production, logistics, payments, or digital services can create operational and financial pressure during extortion negotiations.
How organizations can reside ransomware risk
The findings suggest organizations should expand ransomware defenses beyond traditional privileged technical accounts.
Security teams should consider the authority, relationships, applications, and information available to managers and other business-critical employees.
Organizations can strengthen protection around these high-risk users by implementing several complementary security measures.
- Enforce phishing-resistant MFA and least-privilege access for managers and other high-risk employees to reduce credential abuse and limit what attackers can access.
- Use ransomware protection tools that combine endpoint, network, identity, and behavioral detection to identify and block malicious activity before ransomware can spread.
- Monitor identities and sessions for suspicious activity, including unusual sign-ins, unexpected MFA changes, token misuse, abnormal data transfers, and unauthorized remote access.
- Restrict external communications and verify sensitive requests to reduce impersonation, social engineering, and malicious contact through collaboration platforms.
- Require secondary verification for high-risk actions, including large payments, banking changes, vendor updates, credential resets, and access to sensitive systems.
- Segment critical systems and maintain isolated backups to restrict lateral movement, protect essential data, and support recovery without relying on ransom payments.
- Test incident response plans using attack simulation tools with ransomware scenarios.
Ultimately, effective ransomware defense requires organizations to think about privilege beyond administrator credentials.
Protecting employees based on their access and authority can help prevent a compromised account from escalating into a broader ransomware attack.
Zero Trust can help strengthen this approach by continuously verifying access and limiting how far attackers can move if an account is compromised.