Ransomware gangs are increasingly targeting 40-something IT managers rather than CEOs, according to Zscaler's Threat Labz researchers. Their data tracked 351 victims across 334 organizations in a single campaign over a month. Nearly two-thirds of victims held manager-level titles or above, with an average age of 46 and a strong Gen X skew.

Victims worked in accounting, finance, sales, operations, HR, or marketing, with half in IT or industrial sectors. Rather than blasting indiscriminate emails, attackers combine compromised system data with public information to map reporting lines and identify employees with the authority to accelerate payments. The shift reflects 'business privilege' over technical privilege, targeting those with access to invoices, budgets, supplier contracts, and sensitive business processes.