Loading story…
Zscaler ThreatLabz reported that a real-world ransomware campaign disproportionately compromised employees with business authority rather than only users with obvious technical privilege. In a one-month sample tied to a single ransomware operation, researchers identified 351 victims across 334 organizations, with 62% of victims holding manager-level titles or higher. The campaign was linked to a group known for gaining initial access, stealing large volumes of corporate data, and selectively encrypting critical systems.
The victim set was concentrated in functions that can unlock sensitive business processes: roughly 75% worked in accounting and finance, sales, operations, human resources, or marketing, while 50% were in industrials or information technology. ThreatLabz said these roles can expose payments, contracts, vendor relationships, sensitive records, and cross-business communications that help attackers move laterally and increase extortion pressure. The researchers said organizations should tighten external collaboration controls, strengthen impersonation-focused training, deploy inline network and endpoint detection, monitor for compromise, enforce least privilege, and apply Zero Trust segmentation.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz published research examining employees compromised at the start of a real-world ransomware attack rather than focusing only on the breached organizations and encrypted systems. The research said these victims' roles and authority could help attackers move deeper into organizations.
Over a one-month period, Zscaler ThreatLabz linked 351 victims across 334 organizations to a single ransomware campaign. The researchers found the victims were disproportionately employees with business authority, including 62% with manager-level titles or higher.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcezdnet.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcetheregister.com
Open sourcemalware.news
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have expanded **double-extortion** tactics by targeting people around a victim organization, including senior executives, employees, customers, and business partners, to force ransom payments. Reporting tied the approach primarily to the **Clop** ecosystem, with similar behavior also attributed to **REvil** affiliates. Attackers were described as prioritizing executive mailboxes and workstations to find sensitive files, litigation records, and internal discussions that could be used to embarrass leadership or strengthen negotiations. The pressure campaign also extended beyond the company itself, with gangs emailing victims’ customers and associates to amplify reputational and legal risk. One cited case involved **RaceTrac Petroleum**, where data stolen via exploitation of a zero-day in **Accellion File Transfer Appliance** services used by a third party included some customer contact details, though the company said its corporate network and payment systems were not affected. Similar outreach was reportedly used against people linked to the **University of California**, underscoring how ransomware groups increasingly use public exposure and direct contact with stakeholders as leverage even when stolen data may later be leaked regardless of payment.
Aug 15, 2026
Ransomware groups are increasingly seeking employees, contractors, and business partners who can provide valid credentials, network access, or sensitive data, as stronger perimeter defenses make external intrusion more difficult. Dark-web recruitment activity reflects demand for access to high-value organizations, though insider assistance remains a less common initial-access method than other intrusion routes. Organizations face elevated exposure where offboarding is delayed, privileges are excessive, and access by third parties is insufficiently controlled. Security teams should rapidly deprovision departing personnel, enforce least privilege, MFA, and privileged-access controls, protect backup and hypervisor administration, and monitor endpoints and anomalous access while encouraging employees to report mistakes or suspicious approaches promptly.
Sep 2, 2026
Attackers used **Windows services**, stolen or abused administrative access, and legitimate remote-management tools to prepare and launch a **Midas ransomware** intrusion against an unnamed technology vendor. The operation reportedly lasted at least two months before ransomware was deployed, with the attackers moving laterally through the environment using **PowerShell**, **DISM**, **RDP**, **AnyDesk**, **TeamViewer**, and **Process Hacker**, while also harvesting credentials and exfiltrating data. Investigators found evidence of **Mimikatz** use on at least one server, abuse of administrator-level access on a domain controller, and the creation of services to execute obfuscated scripts and malicious `DismCore.dll` backdoors. The victim’s environment reportedly enabled the intrusion through a flat network, broad VPN access, weak segmentation, and unused remote-access tools left installed on servers. Ransomware deployment began in early December, but the impact was limited to a small number of servers after incident responders intervened and blocked further attacker activity. The case highlights the operational risk posed by unmanaged remote-control software and insufficient monitoring of service creation, lateral movement, privileged access, and remote administration pathways, alongside the need for **MFA** and stronger segmentation or **ZTNA**-style controls.
Aug 14, 2026