Zscaler Research Reveals Managers as Primary Targets in Ransomware Campaigns

Ransomware Targets Managers

Zscaler's ThreatLabz threat intelligence unit conducted research titled "Ransomware Moves up the Org Chart: Managers Are Prime Targets," analyzing an early stage of a real-world ransomware attack. The study, part of the upcoming ThreatLabz 2026 Ransomware Report, focused on identifying common patterns within a specific campaign.

The ransomware group involved in this campaign was known for gaining initial access, exfiltrating corporate data, and encrypting critical systems. Over one month, ThreatLabz identified 351 victims across 334 organizations affected by this single campaign.

Why Managers Are Targeted

The analysis revealed that approximately 62% of the targeted employees held manager-level titles or higher. Around 75% of these individuals worked in accounting, finance, sales, operations, human resources, or marketing. Half of the affected organizations were in the industrial or information technology sectors.

Cybercriminals target managers primarily because they possess higher network and business privileges, granting them access to sensitive records and resources. Additionally, managers control various roles and relationships within an organization, making them valuable targets.

Impact of Compromised Managerial Accounts

Managers handle diverse business tasks, including payment approvals, budget oversight, contract reviews, and inter-departmental coordination. A compromised managerial account can therefore be used by attackers to target different business units and employees, amplifying the potential damage of an attack.