A Single Email Cost One Hospital Chain $100 Million

In 2024, Change Healthcare — a subsidiary of UnitedHealth Group — suffered a ransomware attack that disrupted pharmacy operations, insurance claims, and patient care across the United States. The company paid a $22 million ransom. Total damages exceeded $100 million. The initial entry point? Compromised credentials on a remote access portal that lacked multi-factor authentication.

If you want to defend your organization, you need to understand how ransomware spreads — not in theory, but in the specific, practical ways threat actors actually deliver it. That's what this post covers: the six most common vectors I see exploited right now, with real data and real incidents behind each one.

How Ransomware Spreads: The 6 Vectors That Matter Most

Ransomware doesn't magically appear on your systems. It follows predictable paths. The Verizon 2024 Data Breach Investigations Report found that the human element was involved in 68% of breaches. That means most ransomware infections start with a person — not a zero-day exploit.

Here are the six vectors I see over and over again.

1. Phishing Emails: Still the Undisputed Champion

I've responded to hundreds of ransomware incidents over the years, and phishing remains the number one delivery mechanism. It's not even close. A threat actor sends an email with a malicious attachment or link. An employee clicks it. The payload executes. Game over.

Modern phishing attacks are devastatingly effective. They impersonate vendors, executives, IT departments, and even government agencies. They use urgency and fear — "Your account will be locked in 24 hours" — to bypass rational thinking. The attachment might be a macro-enabled Word document, a ZIP file containing an executable, or a link to a credential theft page that harvests login details for later use.

This is why phishing awareness training for organizations isn't optional anymore. Running phishing simulations and training your employees to recognize social engineering is one of the highest-ROI security investments you can make.

2. Remote Desktop Protocol (RDP) Exploitation

RDP is the second most common way ransomware spreads. Threat actors scan the internet for exposed RDP ports (TCP 3389), then use brute-force attacks or stolen credentials to gain access. Once inside, they have full control of the machine — and often the network.

The FBI's Internet Crime Complaint Center (IC3) has repeatedly warned about RDP as a ransomware vector. During the remote work surge, the number of exposed RDP endpoints skyrocketed. Many organizations never closed those doors.

If you're running RDP, put it behind a VPN. Enforce multi-factor authentication. Limit access by IP address. Better yet, replace it with a zero trust network access solution.

3. Software Vulnerabilities and Unpatched Systems

Threat actors love known vulnerabilities. They don't need zero-days when organizations routinely leave systems unpatched for months or years. The MOVEit Transfer vulnerability (CVE-2023-34362) was exploited by the Cl0p ransomware group to compromise thousands of organizations worldwide, including government agencies and major corporations.

CISA maintains a Known Exploited Vulnerabilities Catalog that tracks actively exploited flaws. If you're not using it as a patch prioritization tool, start today.

The pattern is consistent: a vulnerability is disclosed, a proof-of-concept appears within days, and mass exploitation begins within weeks. Your patch cycle needs to be faster than your adversaries' exploit development cycle.

4. Supply Chain and Managed Service Provider Compromises

This vector is growing fast. Instead of attacking your organization directly, a threat actor compromises your software vendor, your managed service provider (MSP), or a tool in your software supply chain. Then they push ransomware to every customer simultaneously.

The Kaseya VSA attack in 2021 remains the textbook example. The REvil ransomware group exploited vulnerabilities in Kaseya's remote management software and encrypted systems at up to 1,500 businesses in a single weekend. Most of those businesses had never heard of Kaseya — their MSPs used it behind the scenes.

You can't outsource accountability. Vet your vendors. Require security assessments. Include incident notification clauses in your contracts.

5. Drive-By Downloads and Malvertising

Sometimes your employees don't even need to click anything suspicious. Drive-by downloads exploit vulnerabilities in browsers or plugins when a user visits a compromised or malicious website. Malvertising — malicious advertising — injects exploit code into legitimate ad networks, meaning ransomware can be delivered through trusted news sites and search results.

I've seen this catch security-conscious organizations off guard because the user didn't do anything obviously wrong. They visited a legitimate website. The ad network served a malicious payload. Their browser or a plugin had an unpatched vulnerability.

Keep browsers and plugins updated. Use ad blockers on corporate machines. Deploy endpoint detection and response (EDR) tools that catch post-exploitation behavior.

6. Removable Media and Insider Threats

This one's less common in 2026 than it was a decade ago, but it's far from dead. USB drives left in parking lots — the classic social engineering trick — still work. In 2022, the FBI warned about the FIN7 threat group mailing malicious USB drives disguised as Amazon gift cards and COVID-19 guidelines to targeted organizations.

Insider threats also play a role. Disgruntled employees, contractors with excessive access, or compromised accounts from credential theft can all serve as ransomware delivery mechanisms from inside the perimeter.

Disable auto-run on removable media. Enforce least-privilege access. Monitor for unusual data access patterns.

What Happens After Initial Access?

Understanding how ransomware spreads means understanding what happens after the first machine is compromised. Threat actors rarely encrypt immediately. In my experience, the dwell time — the period between initial compromise and ransomware deployment — can range from hours to months.

During that time, the attacker:

  • Moves laterally through the network using stolen credentials
  • Escalates privileges to gain domain admin access
  • Identifies and exfiltrates sensitive data for double extortion
  • Disables or deletes backups
  • Maps the environment to maximize the blast radius
  • Deploys ransomware across as many systems as possible simultaneously

This is why detection speed matters as much as prevention. A phishing email that gets through isn't the end of the world — if you catch the attacker during lateral movement before they reach your backups and critical systems.

How Do You Actually Stop Ransomware From Spreading?

Here's the direct answer: you layer defenses across every vector listed above. No single tool or policy stops ransomware. You need a combination of technical controls, security awareness training, and incident response planning.

The most effective steps I recommend to every organization:

  • Train your people. Comprehensive cybersecurity awareness training reduces the likelihood that phishing and social engineering attacks succeed.
  • Enforce multi-factor authentication everywhere. MFA blocks the vast majority of credential theft attacks. No exceptions for executives or IT admins.
  • Patch aggressively. Prioritize internet-facing systems and anything on CISA's Known Exploited Vulnerabilities list.
  • Segment your network. If ransomware lands on one machine, network segmentation prevents it from reaching everything else. Zero trust architecture takes this further.
  • Maintain offline, tested backups. If your backups are connected to the network, the attacker will encrypt or delete them. Guaranteed.
  • Deploy EDR on every endpoint. Signature-based antivirus alone won't catch modern ransomware. You need behavioral detection.
  • Have an incident response plan — and practice it. The organizations that recover fastest from ransomware are the ones that practiced their response before they needed it.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2024 Cost of a Data Breach Report put the global average cost of a data breach at $4.88 million. Ransomware incidents often cost significantly more when you factor in downtime, recovery, regulatory fines, and reputational damage.

Every one of the six attack vectors I described above is preventable or detectable with the right combination of training, technology, and process. The organizations that get hit hardest aren't the ones that face the most sophisticated attacks. They're the ones that left RDP exposed, skipped MFA, ignored patches, or never trained their employees to recognize a phishing email.

You already know what you need to do. The question is whether you'll do it before or after the ransom note appears on your screen.