Most ransomware are executed from a malware embedded in an infected file downloaded and executed by a user. These are usually delivered as an attachment in phishing emails.