The most significant shift in ransomware strategy this year is not about technology. It is about who gets targeted and why. Threat researchers have found that criminal groups are increasingly skipping chief executives in favour of mid-level managers — the people who control invoices, vendor contracts, and HR records, and who can push for a ransom payment without being surrounded by the legal firewall that insulates the C-suite.
Research from Zscaler ThreatLabz, reported by The Register, tracked 351 victims across 334 organisations caught up in a single ransomware campaign over the course of one month. Nearly two-thirds of those victims held manager-level titles or above. The average victim was a 46-year-old Generation X professional. Three-quarters worked in accounting and finance, sales, operations, human resources, or marketing. Half came from the industrial or IT sectors.
The logic is straightforward. Attackers have learned that a department head controlling a budget can authorise or lobby for payment faster than a chief executive whose response will be managed by lawyers and a crisis communications team. The target profile is shaped not by rank at the top of the org chart, but by what researchers describe as "business privilege" — access to the financial and contractual data that makes a victim both vulnerable to exposure and motivated to pay quickly.
According to elseif.net, attackers are now conducting detailed reconnaissance to map organisational hierarchies before launching an attack, prioritising access to invoices, budgets, contracts, and HR records over targets such as system administrators with network-wide technical rights. The implication for corporate security postures — many of which concentrate protections on the C-suite and IT administrators — is that existing defences may be misaligned with where attacks are actually landing. It is not yet known whether this targeting approach is consistent across all major ransomware groups or confined to specific operators, and the identity of the group behind the 351-victim campaign tracked by Zscaler has not been disclosed.
This precision is unfolding against a backdrop of sharply rising overall attack volumes. Comparitech counted 799 ransomware incidents in July 2026, up from 668 in June, making it the second-busiest month of the year behind March's 805, The Register reported. That represents a near-20% monthly increase. Sector-level spikes were steeper still: attacks against finance companies rose 71% in July, technology firms 62%, pharmaceutical companies and medical billers 46%, and the education sector 44%.
The longer trend is equally pronounced. Extortion-related cyberattacks rose roughly 63% in 2025, reaching approximately 6,800 incidents, according to Cybersecurity Dive, citing analysis of dark-web forums by threat intelligence firm Intel 471. The United States accounted for more than half of all extortion victims that year, with threat actors exploiting more than 40% of the 520 vulnerabilities disclosed in 2025. Separately, BlackFog's second-quarter report found that undisclosed ransomware attacks — incidents that never become public — surged 40% year on year, according to AOL.
The methods used to extract payment have grown more layered. Ransomware operators are increasingly using what Sophos describes as the weaponisation of legitimate entities: alerting journalists to breaches, filing complaints with regulators, and in some cases encouraging affected customers of a victim organisation to launch litigation. The intent is to generate external pressure that the victim's own legal and communications teams cannot contain quickly enough.
Data theft has also increasingly displaced encryption as the primary extortion lever. Cybersecurity Dive reported that Unit 42, Palo Alto Networks' threat research group, found encryption was skipped altogether in roughly one in ten ransomware incidents it responded to in late 2021 and 2022, while data theft jumped from 40% to 70% of attacks over the same period and harassment tactics spiked twenty-fold. The shift is commercially rational: stolen data can be used to extort a victim repeatedly, or sold to third parties, whereas encrypted systems can sometimes be restored from backups without payment.
Taken together, the picture is of a criminal industry that has moved from indiscriminate volume attacks toward something closer to targeted commercial intelligence operations. Groups now invest in pre-attack research — profiling individuals, mapping organisational charts, identifying who controls budgets — before deploying any malicious code. The victim most at risk is no longer necessarily the person at the top of the hierarchy. It is the person in the middle who holds access to financial and operational data and has enough authority to act, but not enough institutional insulation to stall.
What is clear is that the attack surface is widening, the intelligence-gathering phase before each attack is becoming more sophisticated, and the sectors absorbing the sharpest volume increases — finance, healthcare, education — are among those with the most sensitive data to expose.
Comments (0)