Ransomware gangs skip the CEO, head straight for the 40-something IT manager

Ransomware attackers are increasingly targeting 40-something IT managers rather than company CEOs, according to a recent report by Zscaler. The data reveals that nearly two-thirds of victims targeted in a single ransomware campaign held manager-level titles or above, with the average victim being a 46-year-old Gen Xer. These cybercriminals conduct extensive research to map reporting lines and identify employees most likely to influence a company's response to a ransom demand.

Instead of randomly targeting executives, attackers focus on managers with the authority or influence to expedite payment decisions, such as those involved in invoicing, payment approvals, budgets, supplier contracts, customer accounts, HR records, or other sensitive business processes. This shift reflects a trend towards "business privilege" rather than technical privilege, as attackers seek employees with comprehensive access to business operations.

The Gen X demographic is particularly attractive to attackers, as many individuals in this age group have reached established management positions, providing them with valuable systems, sensitive information, and decision-making authority. Furthermore, the report highlights that more than a dozen organizations experienced multiple employee compromises during the campaign, indicating that attackers do not stop at a single point of entry and work their way through various business functions to maximize their chances of accessing valuable data and personnel.

Overall, the ransomware landscape has evolved from indiscriminate attacks to highly targeted extortion campaigns, with attackers already possessing detailed knowledge of their victims' organizational structures and decision-making processes by the time the ransom note is sent.