Spear-Phishing
The most common delivery system for ransomware is a phishing email that includes an attachment or a link. When the user opens the attachment or clicks the link, the ransomware runs a program that locks the system, and displays a demand for payment. When this happens, the only way to decrypt the data is through a mathematical key only known by the attacker.
There have also been cases where malware will display a message claiming that the user's 'Windows' is locked. The user is then encouraged to call a Microsoft phone number and enter a six-digit code to reactivate the system. The message alleges that the phone call is free, but this isn't true. While on the phone calling the fake 'Microsoft', the user racks up long-distance call charges.
Remote access points
McAfee researchers observed while cybercriminals are still using spear-phishing tactics, an increasing number of attacks are gaining access to a company that has open and exposed remote access points, such as RDP and virtual network computing (VNC). RDP credentials can be brute-forced, obtained from password leaks, or simply purchased in underground markets. Where past ransomware criminals would set up a command and control environment for the ransomware and decryption keys, most criminals now approach victims with ransom notes that include an anonymous email service address, allowing bad actors to remain better hidden