Zscaler Blog

When a ransomware attack makes headlines, attention usually turns to the organization that was breached, the systems encrypted, data stolen, and disruption or ransom demand that followed. Less, if anything, is revealed about the employees compromised at the start of the attack, and what makes those individuals valuable targets.

New Zscaler ThreatLabz research examines this early stage of a real-world ransomware attack. ThreatLabz identified victims of a campaign associated with a ransomware group known for gaining initial access, stealing large amounts of corporate data, and selectively encrypting critical systems. The findings show who those victims were and how their roles and authority could help an attacker move deeper into an organization.

This is part of ongoing ransomware research by ThreatLabz. The Zscaler ThreatLabz 2026 Ransomware Report, coming in the next two months, will include additional data on ransomware victims, the latest ransomware trends, targets, and tactics, and the risks enterprises should prepare for next.

Key Findings At a Glance

Over a one-month period, ThreatLabz identified 351 victims across 334 organizations linked to a single ransomware campaign.

• 62% of victims held manager-level titles or higher
• Roughly 75% of victims worked in accounting and finance, sales, operations, human resources, or marketing
• 44% of victims were members of Generation X; the average victim age was 46
• 50% worked for companies in the industrial or information technology sector
• More than a dozen organizations had multiple employees compromised

What the Victims Look Like

The following profiles are real-world examples of the victims represented in the research.

Regional Sales Manager
Industry: Industrials
Why the role may be targeted: Access to customer accounts, contracts, pricing, revenue forecasting, and sales communications, jeopardizing major orders and service or equipment contracts and putting customer relationships and revenue at risk.  

Accounts Payable Manager
Industry: Information Technology
Why the role may be targeted: Access to invoices, payment data, financial approvals, and vendor records, potentially disrupting payments to critical suppliers and affecting the delivery of technology products and services across the business. 

Senior Project Manager
Industry: Consumer Discretionary
Why the role may be targeted: Access to project budgets, roadmaps, and sensitive files or documents, delaying product launches or location openings, increasing project costs, and causing the business to miss critical revenue opportunities.

Property Manager  
Industry: Real Estate 
Why the role may be targeted: Access to lease agreements, vendor invoices, contracts, client data, and financial information, creating potential for tenant service interruptions, legal exposure, and loss of property income.

These employees do not need administrator rights to create serious business exposure. Their everyday access can provide attackers with a path to sensitive data, financial and operational processes, enterprise applications, and internal communications.

Strengthen Ransomware Defenses Around Manager Roles

Managerial roles require protections that address how attackers approach employees and what they can access after an account is compromised. As AI makes reconnaissance, personalization, and impersonation faster and more convincing, ransomware actors can target these employees with fewer obvious warning signs. To this end, key priorities for security teams include: 

• Restrict external communications on collaboration platforms. Block unsolicited messages and calls from external users on platforms such as Microsoft Teams and Slack.
• Prepare employees for impersonation attempts. Train users to verify unusual requests from purported IT personnel through trusted internal communication channels and company directory information before taking action.  
• Deploy inline network threat and endpoint security protection. Use AI-powered network and endpoint detection solutions to identify malicious content, suspicious behavior, and attack activity before it can progress.
• Continuously monitor activity for signs of compromise. Look for unusual behavior across users, devices, applications, data transfers, and remote access tools. In this campaign, more than a dozen organizations had multiple victims, underscoring the need to monitor and investigate beyond the first affected account.
• Enforce least-privilege access. Limit each employee’s access to the applications, systems, and data required for their role, reducing what attackers can reach through a compromised account.  
• Implement a Zero Trust architecture to contain attacks. Segment access to prevent attackers from moving laterally and reaching additional systems after gaining an initial foothold.

Stay Tuned: More Ransomware Research Ahead

Understanding which employees ransomware groups are targeting provides important insight into where business access creates exposure. It also reveals where stronger protections are needed to prevent one compromised account from leading to data theft, encryption, or wider disruption.

View the brief for an at-a-glance summary of the findings in this research.

Follow ThreatLabz on X and our security research blog to stay informed about the latest threat discoveries, campaign analysis, and security insights.

Watch for the upcoming ThreatLabz 2026 Ransomware Report to learn more about the victims in this campaign, along with in-depth research on ransomware activity over the past year, the groups driving it, evolving data theft and extortion trends, and more.

Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.

Explore more Zscaler blogs

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.