Ransomware crews have discovered middle management. This is not a joke, although it has the shape of one.
Zscaler's ThreatLabz researchers looked at 351 victims across 334 organizations in a one-month campaign associated with a ransomware group. The pattern was not "attack the CEO" or "find the domain admin and begin the ritual." Sixty-two percent of the identified victims held manager-level titles or higher. Roughly three quarters worked in accounting and finance, sales, operations, human resources, or marketing. The average victim age was 46, which has caused the internet to briefly perform its scheduled generational taxonomy argument. Fine. We can let marketing fight the calendar in the break room.
The useful finding is not age. The useful finding is authority.
Security programs are very familiar with technical privilege. Root. Domain admin. Cloud owner. Break glass accounts. Service principals with suspiciously enthusiastic permissions. These deserve attention because they can turn one bad credential into a business interruption with invoices.
But ransomware is not only a technical event. It is a business negotiation performed under duress, after reconnaissance, with stolen data on the table. That means attackers care about business privilege: the authority, access, relationships, and institutional knowledge that make a person operationally useful.
An accounts payable manager may not be able to push a malicious Group Policy Object. They may still see invoices, vendor records, payment schedules, banking details, approval workflows, and the quiet map of who panics when a supplier is not paid. A sales manager may not own the identity provider. They may have contracts, pricing, customer escalations, renewal pressure, and enough relationship context to make extortion personal. An HR manager may not administer the network. They may have employee records, compensation details, investigations, benefits data, and organizational charts that turn vague threats into specific ones.
This is privilege. It just does not wear a black T-shirt that says "sudo."
The Register's summary of the same research put it plainly: attackers are combining information from compromised systems with public data to map reporting lines and identify employees who can influence a company's response. Hacker News commenters added the part many companies prefer not to inspect: public data is only one shelf in the reconnaissance store. Commercial people-data brokers, sales intelligence tools, recruiting databases, lead enrichment platforms, conference bios, LinkedIn trails, vendor portals, and leaked inbox archaeology all help assemble the same map.
The org chart used to be internal paperwork. Now it is targeting data with a subscription tier.
This should bother more people than it currently does. Not because every manager needs to become a security analyst. That would be cruel and also ineffective. It should bother people because many defenses still assume that the dangerous users are the ones who can change infrastructure. Attackers have a broader definition. They ask who can move money, stall operations, approve exceptions, pressure vendors, calm executives, access embarrassing records, or make the company believe paying is cheaper than delay.
That is not shadow IT. That is the operating system of the business.
The failure mode is familiar. A company protects the administrative console but leaves the finance workflow socially porous. It hardens endpoint builds but allows unsolicited external messages in collaboration tools. It requires MFA for the VPN but treats vendor portals, shared drives, contract systems, CRM exports, HR platforms, and executive assistants' mailboxes as ordinary office furniture. It trains employees to spot generic phishing while attackers use real names, real suppliers, real projects, and real deadlines.
Then, after the breach, everyone asks why the attacker knew so much.
Because the company told them. Slowly. Across platforms. In procurement documents, partner announcements, social profiles, data broker records, leaked credentials, CRM breadcrumbs, and the thousand small disclosures that feel harmless when reviewed one at a time. Reconnaissance is patient accounting with worse ethics.
There is another uncomfortable piece. Ransomware crews are learning from normal business.
Enterprise sales teams already map buying committees. Recruiters map reporting lines. Vendors identify budget owners. Consultants find the person who can say yes. Attackers are not inventing a new model of influence; they are using the existing one without the harmless lanyard. If your business process depends on informal authority, undocumented exceptions, and personal trust chains, then those things are part of the security model whether the security team has drawn them or not.
This does not mean every manager should be locked in a digital panic room. Business still has to function. A company where nobody can approve a payment, sign a contract, view employee records, or talk to a supplier is not secure. It is closed.
The better answer is to threat-model business authority as deliberately as technical authority.
Start with the roles attackers would love during an extortion campaign: finance approvers, HR record holders, sales and customer escalation leads, operations managers, procurement owners, legal and contract staff, IT managers with vendor access, executive assistants, and anyone who can bridge departments without raising eyebrows. Ask what data they can export, what systems they can reach, what approvals they can trigger, who trusts messages from them, and what external parties can contact them directly.
Then put controls around the actual blast radius. Restrict unsolicited external messages and calls in Teams, Slack, and similar platforms. Require out-of-band verification for unusual payment, access, vendor, HR, or contract requests. Watch for abnormal downloads, mailbox rules, SaaS exports, remote access tools, new OAuth grants, and sudden access across business systems. Apply least privilege to CRM, HRIS, ERP, contract repositories, shared drives, and vendor portals with the same seriousness usually reserved for cloud consoles. Practice incident response with finance, HR, legal, sales, procurement, and operations in the room, not waiting outside for the technical people to finish the interesting part.
Also: stop treating org charts as harmless. Limit what is public, what is sold through vendors, what is exposed in collaboration tools, and what can be scraped from employee profiles. The attacker only needs enough structure to make the next message plausible.
Ransomware did not move up the org chart because managers are foolish. It moved there because managers are connected to money, records, vendors, deadlines, and pressure. That is the work. That is also the leverage.
The practical question is simple and mildly rude: if an attacker compromises one business-privileged employee tomorrow, what can they learn, who can they impersonate, what can they approve, and how long before anyone notices?
If the answer is "we have MFA," please sit down. We have more diagramming to do.
References
- Zscaler ThreatLabz, "Ransomware Moves up the Org Chart: Managers Are Prime Targets" (August 6, 2026): https://www.zscaler.com/blogs/security-research/ransomware-moves-org-chart-managers-are-prime-targets
- The Register, "Ransomware gangs skip the CEO, head straight for the 40-something IT manager" (August 9, 2026): https://www.theregister.com/security/2026/08/09/ransomware-gangs-skip-the-ceo-head-straight-for-the-40-something-it-manager/5284499
- Hacker News discussion of The Register article (August 9, 2026): https://news.ycombinator.com/item?id=49234724