How does ransomware get in through email, and how do you stop it?

Ransomware gets the headlines, but email is usually where it starts. A malicious attachment installs a loader. A fake sign-in page steals a password. A flood of spam is followed by a "help desk" call that ends with remote access. Days or weeks later, files are encrypted and data is stolen. This guide traces how email leads to ransomware, what CISA's #StopRansomware Guide recommends for email, and what to do in the first hour if someone opened something they shouldn't have.

How big is the ransomware problem?

The FBI's 2025 IC3 Annual Report says the IC3 "received more than 3,600 complaints reporting ransomware with losses exceeding $32 million" in 2025. The most frequently reported variants were Akira, Qilin, INC/Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay and Medusa.

The FBI warns that the loss figure is low. It "does not normally include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services," and some victims report no loss at all. It also only counts reports made to IC3.

How does ransomware arrive through email?

Ransomware is usually the last stage of an intrusion, not the first. CISA's #StopRansomware Guide says "A ransomware infection may be evidence of a previous, unresolved network compromise," and that "many ransomware infections are the result of existing malware infections, such as QakBot, Bumblebee, and Emotet." Email shows up in several of these paths.

Attachments and loaders

Attackers pick file types that slip past filters or get users to run code. CISA notes that "OneNote attachments with embedded malware have recently been used in phishing campaigns" and that "Malware is often compressed in password protected archives that evade antivirus scanning and email filters." Our guide to dangerous email attachment types covers which to block and which to quarantine, and HTML smuggling explains why HTML attachments are risky.

Macros used to be the default route. Microsoft says "VBA macros are a common way for malicious actors to gain access to deploy malware and ransomware" (Microsoft Learn), which is why Office now blocks macros in files from the internet. See Office macros blocked from the internet.

Stolen passwords

A phished password for email or VPN can be enough. The FBI's ransomware recommendations in the IC3 report include enabling MFA "for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems." Phishing kits that relay MFA codes in real time make weaker MFA less effective, as our guide to adversary-in-the-middle phishing explains.

Spam floods and fake IT calls

CISA's Black Basta advisory says its affiliates "primarily use spearphishing" for initial access. In one 2024 campaign, "targeted users were sent a large volume of spam email," followed by calls asking them to "download a tool for remote access, such as AnyDesk or Microsoft's Quick Assist." Microsoft described the same pattern from a group it tracks as Storm-1811, which led to Black Basta ransomware. See email bombing and callback phishing for detail.

What does CISA's #StopRansomware Guide say about email?

The guide, published by CISA, the FBI, the NSA and MS-ISAC and last revised in October 2023, groups its advice by initial access vector. Under "Phishing," it recommends:

1. Awareness training. "Implement a cybersecurity user awareness and training program that includes guidance on how to identify and report suspicious activity (e.g., phishing) or incidents."
2. External sender flags. "Implement flagging external emails in email clients." Our guide to the Outlook external email tag shows how.
3. Gateway filtering. "Implement filters at the email gateway to filter out emails with known malicious indicators, such as known malicious subject lines, and block suspicious Internet Protocol (IP) addresses at the firewall."
4. Attachment filters. "Enable common attachment filters to restrict file types that commonly contain malware and should not be sent by email," and review the list "at least semi-annually." Microsoft 365's version is described in Microsoft Learn.
5. DMARC. "Implement Domain-based Message Authentication, Reporting and Conformance (DMARC) policy and verification to lower the chance of spoofed or modified emails from valid domains." The guide adds an important limit: DMARC "does not protect from incoming emails that have been spoofed unless the sending domain also implements DMARC."
6. Macros off. "Ensure macro scripts are disabled for Microsoft Office files transmitted via email. These macros can be used to deliver ransomware."
7. Windows Script Host off. "Disable Windows Script Host (WSH)."

Under "Compromised Credentials," it adds: "Implement phishing-resistant MFA for all services, particularly for email, VPNs, and accounts that access critical systems."

Which layered defenses stop email-borne ransomware?

No single control is enough. Each layer catches what the one before it missed.

CISA's guide is blunt about backups: keep "offline, encrypted backups of critical data," because "most ransomware actors attempt to find and subsequently delete or encrypt accessible backups." It also warns that automated cloud sync isn't a backup, since encrypted local files "will be synced to the cloud, possibly overwriting unaffected data."

A short email checklist

1. Check that your domain enforces DMARC with the DMARC Checker.
2. Block executables, scripts and disk images. Quarantine macro-enabled Office files, HTML and password-protected archives.
3. Turn on external sender tagging.
4. Require MFA on every mailbox, and phishing-resistant methods for admins.
5. Give users a one-click way to report suspicious mail, and tell them a fake "help desk" call is a known attack.
6. Review quarantine regularly so held messages are released or removed promptly.

What should you do if a user opened something suspicious?

Speed matters, and so does staying calm. The #StopRansomware Guide's response checklist starts with containment.

For the user

1. Stop. Don't enable content, run more files or enter more passwords.
2. Disconnect the device. Unplug the network cable or turn off Wi-Fi. Don't shut it down unless IT tells you to.
3. Call IT or your provider by phone. Use a number you know, not one in the email.
4. Report the email with your mail app's report button, and don't forward it to colleagues.
5. If you entered a password, follow what to do after clicking a phishing link.

For IT

1. Isolate affected systems. CISA says to "Determine which systems were impacted, and immediately isolate them," taking the network offline at the switch level if several systems are affected.
2. Power down only if you can't disconnect. CISA notes that powering down loses "potential evidence stored in volatile memory."
3. Use out-of-band communication. CISA warns attackers "may monitor your organization's activity or communications," so coordinate by phone rather than email.
4. Look for precursor malware and stolen access. Check endpoint and email logs for the same message in other mailboxes, new inbox rules, and new remote access tools.
5. Purge the email from every mailbox, and block the sender, URLs and file hashes.
6. Reset and revoke. Reset passwords and sign-in sessions for affected users.
7. Report it. The FBI says: "If you are impacted by ransomware or cybercrime, file a report with IC3."

On payment, the guide says: "The authoring organizations do not recommend paying ransom. Paying ransom will not ensure your data is decrypted, that your systems or data will no longer be compromised, or that your data will not be leaked."

Next steps

• Read the #StopRansomware Guide and check your email controls against its phishing section.
• Test a backup restore this month.
• Run an Email Health Check to confirm your MX, SPF and DMARC are in order.
• Write down who users should call if they open something suspicious, and share it.
• iBlockSpam filters spam, viruses, malware and phishing at the MX level, with attachment-type filters and a Microsoft Office macro filter, before mail reaches your server. See how it works.

Browse our other phishing and threat guides.