Ransomware Gangs Are Skipping CEOs And Coming After Managers

New research suggests ransomware operators are shifting their focus away from senior executives to those who do more day-to-day work.

For years, cybersecurity awareness campaigns have been warning executives about spear-phishing attacks and business email compromise schemes. However, new research suggests ransomware operators are increasingly focused on a new target: department managers who have access to critical business systems and sensitive data.

[RELATED: Payroll, HR Teams Targeted In New Business Email Compromise Campaign]

Zscaler's ThreatLabz is currently conducting research on ransomware. Researchers have identified 351 ransomware victims across 334 organizations, all linked to a single ransomware campaign. The research has uncovered some surprising findings:

-62 percent of victims held manager-level titles or higher

-Approximately 75 percent of victims worked in accounting and finance, sales, operations, human resources or marketing

-44 percent of victims were members of Generation X; the average victim age was 46

-50 percent worked for companies in the industrial or information technology sector

-More than a dozen organizations had multiple employees compromised

Why Managers?

Managers are not targeted at random. IT managers usually have elevated user account privileges across multiple systems. Attackers know that compromising a user account at that level can potentially provide widespread access inside a corporate network environment, allowing them to move deeper inside an organization.

Managers in accounting and finance are targeted most, according to the report's data. The reasons are fairly obvious. These employees have access to invoices, payments, banking information and other financial data. Managers in sales, operations and HR round out the next top three most targeted employees.

The report also revealed that these accounts don't even necessarily have to have admin rights. They typically have elevated enough permissions to provide attackers access to sensitive data, financial and operational processes, enterprise applications, and internal communications, according to the report.

Strengthening Manager Roles

ThreatLabz researchers offer several suggestions for keeping managerial roles safe. Much of that advice is aligned with MES Computing's interviews with security experts: implement zero trust, enforce least-privilege access, and constant monitoring for anomalies or any indications of compromised accounts.

[RELATED: Midmarket IT Faces Enterprise-Scale Threats On A Smaller Budget. Here’s How Leaders Are Rethinking Zero Trust.]

In addition, the researchers suggest restricting external communications on collaboration platforms like Teams and Slack. Also, train employees to spot impersonation attempts—emails that may show up as unusual requests from purported IT team members, for example.

Bottom Line For Midmarket IT Leaders

For IT leaders, the findings underscore that ransomware defense is no longer just a tech issue. Organizations must also evaluate which employees have elevated privileges, broad system access, and authority to make decisions during an incident.

Attackers are becoming more specific about who they target. It is up to organizations to evolve security awareness training beyond traditional executive protection strategies and focus on managers whose day-to-day access makes them attractive targets for hackers.