Ransomware Gangs Have Discovered Middle Management

Security teams have spent a decade building defenses around two assumptions: attackers want admin rights, and social engineers want executives. New data from Zscaler's ThreatLabz suggests ransomware crews have quietly abandoned both plays. Tracking a single ransomware campaign over one month, researchers identified 351 victims across 334 organizations — and 62% of them held manager-level titles or above. The average victim was 46 years old. Three-quarters worked in accounting and finance, sales, operations, HR, or marketing.

Not CISOs. Not domain admins. Not the CEO. The person approving invoices and running the quarterly budget review.

Business privilege beats root

ThreatLabz calls the pattern "business privilege": attackers are selecting targets by what their role can touch, not what their credentials can sudo. A mid-level manager's account typically can't reach production infrastructure, but it can read supplier contracts, payment approvals, customer accounts, and HR records — which is exactly the data that fuels double-extortion. The campaign Zscaler analyzed followed the now-standard playbook of stealing large volumes of corporate data and only selectively encrypting systems, so the manager's mailbox and SharePoint access is the payload.

There's a second reason this tier is attractive, and it's more cynical: leverage over the ransom negotiation itself. Zscaler found attackers combining data from compromised systems with public information to map reporting lines and identify the employees "most likely to influence a company's response." More than a dozen organizations in the dataset had multiple employees compromised. If you can pressure the people who brief the executives — the ones who know exactly what was stolen and how bad it is — you don't need to phish the executives at all.

The demographic detail (44% Gen X, average age 46) has gotten the headlines, but it's mostly a base-rate effect, not evidence that mid-career staff are more gullible. Forty-six is simply the age at which people hold established management roles with real approval authority. Attackers aren't profiling generations; they're profiling org charts, and org charts have a median age.

The middle of the org chart is soft

What makes this shift credible is that it's the logical next move in a progression we've been watching for three years. Whaling and BEC taught executives (and their assistants, and their mail filters) to be paranoid; most large companies now run exec-protection programs. On the technical side, IT admins increasingly sit behind phishing-resistant MFA, privileged access workstations, and tiered admin models — the direct result of Scattered Spider's help-desk vishing campaigns and Black Basta's fake-IT-support chats on Microsoft Teams. The top of the org chart and the top of the privilege hierarchy both got hardened.

The middle got neither. A finance manager or engineering lead has broad SaaS access, standing approval workflows, a public LinkedIn profile that advertises their reporting line, and — critically — security training that still teaches them the attacker is after "the boss" or "the admins." They're the highest-value population that no control regime specifically covers.

The macro numbers say attackers have every incentive to keep refining target selection. Zscaler's 2025 ransomware report logged a 146% year-over-year jump in blocked ransomware attempts and a 92% increase in exfiltrated data volume, with public extortion cases up 70%. When the business model is extortion-first, precision targeting of people with data access and negotiation influence beats spray-and-pray encryption on pure ROI.

What to actually change

If you run security for a dev or ops org, the practical implication is that your definition of "privileged user" is wrong, or at least incomplete. Some concrete moves:

• Extend admin-grade identity controls to approval authority. Anyone who can approve a payment, sign a contract, or access bulk HR/customer data should be on phishing-resistant MFA (FIDO2 keys, not push notifications) and conditional access policies — the same tier you'd apply to a production deployer. Number-matching push MFA is what Scattered Spider eats for breakfast.
• Close the external-collaboration door. Zscaler's top recommendation is blocking unsolicited external messages on collaboration platforms, and it's cheap. In Microsoft Teams, external access is open by default; move to an allowlist:

Set-CsTenantFederationConfiguration -AllowFederatedUsers $false

Then re-enable only the partner domains you actually work with. Slack Connect deserves the same audit.

• Write the "personalized extortion" runbook. The scenario your IR plan probably doesn't cover: a 46-year-old ops manager gets an email quoting their own salary data and naming their VP. If the first person they think to call is legal or nobody, you lose days. Make the reporting path one click and blameless.
• Treat business SaaS like prod. Least privilege, session monitoring, and DLP on the finance and HR systems, not just on Kubernetes. The data that gets you extorted lives in NetSuite and Workday, not in your cluster.

Real shift, with one caveat

Is this vendor threat-intel dressed up as a trend? Partly — it's one campaign, one month, one vendor's telemetry, and the group behind it isn't even named. Victim demographics also skew toward people who are enumerable: managers have richer LinkedIn footprints, so both attackers and researchers find them more easily. Treat the specific percentages as directional.

But the direction lines up with everything else we can observe independently: extortion-first economics, hardened executive and admin tiers, and social-engineering crews that already pivoted from mass phishing to researched, individual pretexts. The middle manager isn't a novel victim class — BEC crews have targeted finance staff for years. What's new is ransomware operators formalizing it: mapping reporting lines before first contact and compromising several mid-level employees per org to control both the data and the narrative during negotiation.

The uncomfortable takeaway for anyone building a security program: your org chart is your attack surface, and the most exposed nodes are the ones your controls, your training budget, and your threat model all currently skip.