Ransomware attacks increasingly target managers, not just CEOs

Ransomware attacks are shifting their focus from top executives to mid-level managers, particularly those in IT, accounting, and finance. This strategy aims to expedite ransom payments by targeting individuals with direct influence over financial and operational decisions. This trend was identified by Zscaler's ThreatLabz researchers, as reported by The Register.

Ransomware campaigns are becoming more sophisticated, moving away from broad attacks to highly targeted extortion. Researchers found that attackers are researching organizations to identify managers, often Gen Xers, who have the authority to approve payments or access sensitive business data. These individuals are frequently found in accounting, finance, sales, operations, HR, and marketing departments, with a significant presence in the industrial and IT sectors. Attackers leverage publicly available information and compromised systems to map reporting structures and pinpoint these influential employees.

This approach, termed "business privilege" by Zscaler, contrasts with traditional security focus on technical privileges. The attackers' goal is to increase the likelihood of a ransom payment by targeting those who can accelerate decision-making processes, rather than solely relying on encryption. This shift is reflected in a 146% increase in blocked ransomware attempts, a 70% rise in public extortion cases, and a 92% climb in stolen data volume over the past year.

Source: The Register