Ransomware Targeting Managers: Zscaler Data Points Past the CEO

Who ransomware crews are going after

The usual picture of extortion is an attacker going straight to the chief executive. New research from Zscaler ThreatLabz points somewhere else: middle and senior managers. These are people with enough authority to shape how a company responds, but who get far less security attention than the C-suite.

ThreatLabz followed one ransomware campaign for a month. It covered 351 victims across 334 organizations. Nearly two-thirds of those victims held manager-level titles or higher 3. The average victim was 46 years old. Three-quarters worked in accounting and finance, sales, operations, HR, or marketing, and half were employed in the industrial or IT sectors 3. eSecurity Planet puts the share at manager level or above at exactly 62% and reports the same 75% concentration in those business functions 4.

The researchers say the targeting is deliberate. Attackers don't send one extortion message to everyone in an organization. They combine what they find on compromised systems with public information to map reporting lines. That lets them pick out the employees most likely to influence how the company reacts 3.

The bigger numbers, and a framing gap

These findings sit inside Zscaler's wider 2026 Ransomware Report, which covers April 2025 to March 2026. According to ITdaily's summary, ransomware attacks rose more than 275% over that year, and attackers stole close to 900 terabytes of data 5. The report says extortion now depends less on visible encryption and more on stealing data and threatening to publish it. Attackers also lean on trusted business tools and generative AI to move faster 5.

The outlets describe the 62% figure differently. ITdaily presents it as executives or privileged roles being targeted in 62% of cases, and its headline stresses executives 5. The Register and eSecurity Planet place the figure in the month-long, single-campaign sample and describe the victims as managers rather than top leadership 34. The second reading fits the data better. A finding drawn from 351 people in one campaign is a useful signal, but it is not a census of all ransomware activity. Calling these victims "executives" also hides the more interesting point: the targets are often the IT manager or the finance lead, not the CEO.

How the access gets in: infostealers and unmanaged devices

The Zscaler coverage focuses on who is targeted. Separate research on infostealer malware helps explain how attackers obtain the access and the internal detail needed to profile those people. Infostealers quietly collect credentials, browser cookies, payment data, and crypto wallet keys. They package the haul into "stealer logs" that sell on dark-web markets and Telegram for anywhere from about $1 to more than $100 per log 2. Initial access brokers search these logs for corporate VPN and remote-desktop logins and resell network access for hundreds or thousands of dollars 2. One analysis found that more than half of recent ransomware victims showed infostealer traces beforehand 2.

Personal devices are a significant weak spot. Roughly 46% of corporate credentials found in infostealer logs come from unmanaged personal devices, according to one security response guide 1. Those logs often contain authenticated session cookies, which can let attackers bypass multi-factor authentication altogether 1. The same guide says exposure of credentials for major SaaS and cloud services is growing about 29% a year, and that around 90% of logs now circulate through Telegram, where ransomware affiliates can easily buy them 1. It describes a case in which Vidar malware infected an employee's personal machine far from any corporate office and harvested both SaaS credentials and live session cookies 1.

The Zscaler figures cited here do not state that the managers in its campaign were compromised through personal devices. That link is an inference. Still, the pieces fit together. Managers in finance, HR, and operations hold valuable SaaS access, often work from several devices, and are prime candidates for having credentials end up in a stealer log.

Why it matters

Security programs tend to protect the most senior executives with extra controls and leave the management layer below them with standard protections. This research suggests attackers have noticed that gap. Mid-level leaders have real business authority, broad access, and enough influence over the response to an incident, which makes them efficient targets. They are also less closely watched than the CEO 34.

The practical lessons follow from that:

• Extend high-risk protections to managers in finance, HR, sales, and operations, not just the executive suite.
• Watch for leaked credentials and session cookies, including those from personal devices that endpoint tools never see 1.
• Treat stolen session tokens as an MFA bypass, not a minor password problem. Revoke the sessions, not only the passwords 1.

The biggest danger in this research is not that attackers are getting smarter about the CEO. It is that they have found a less-defended group of employees one level down who can still move the company to pay.