Ransomware Campaign Went After Managers With Business Access, Zscaler Finds

A single ransomware campaign tracked by Zscaler ThreatLabz hit 351 people at 334 organizations in one month, and most of them were managers in business roles rather than IT administrators or executives. The research, by senior director of threat intelligence Brett Stone-Gross, looks at who was compromised at the start of the attacks.

ThreatLabz linked the campaign to a group known for gaining initial access, stealing large amounts of corporate data and selectively encrypting critical systems. Among the victims:

• 62% held manager-level titles or higher.
• Roughly 75% worked in accounting and finance (17.7%), sales (17.4%), operations (16.8%), human resources or marketing.
• 44% were Generation X. Ages ran from 23 to 70, with an average of 46.
• Half worked in industrials (35.5%) or information technology (14.6%).
• More than a dozen organizations had multiple employees compromised.

Business privilege, not admin rights

Security teams usually define privileged users as administrators. Zscaler argues attackers also go after “business privilege,” the access that comes with a role. “The value of a compromised managerial account lies in the breadth of business access associated with the position,” the researchers wrote. “Managers may approve payments, oversee budgets and vendors, review contracts, access sensitive records, or coordinate work across business units.”

The Gen X skew, Zscaler said, may be less about age than career stage, since many people in that group hold established management jobs. Attackers combine data from compromised systems with public information to map reporting lines and find the employees most likely to influence a company’s response, The Register reported. The Register also cited wider Zscaler figures: ransomware attempts blocked on its cloud platform rose 146% over the past year, public extortion cases rose 70% and the volume of stolen data climbed 92%.

What Zscaler recommends

The company’s list starts with blocking unsolicited messages and calls from external users on Microsoft Teams and Slack, and training staff to verify unusual requests from supposed IT personnel through internal channels and the company directory. It also recommends least-privilege access, segmentation to stop lateral movement, and monitoring that looks past the first compromised account, given how many organizations had more than one victim.

ThreatLabz said its 2026 Ransomware Report, due within two months of the research, will include more data on this campaign’s victims.