A Single Email Took Down a $5.8 Billion Pipeline

In May 2021, a single compromised password shut down Colonial Pipeline and triggered fuel shortages across the U.S. East Coast. The attack didn't start with some exotic zero-day exploit. It started with a stolen credential and an exposed VPN. If you want to understand how ransomware spreads, that incident is your case study — because the vectors haven't fundamentally changed, they've just gotten faster and more automated.

I've responded to ransomware incidents at organizations of every size. The pattern is almost always the same: a human mistake, a misconfigured system, or an unpatched vulnerability gives a threat actor a foothold. From there, they move laterally, escalate privileges, and deploy the payload. Understanding these attack vectors isn't academic — it's the difference between a normal Tuesday and a seven-figure disaster.

What Is Ransomware and Why Does It Keep Working?

Ransomware is malware that encrypts your files and demands payment — usually in cryptocurrency — for the decryption key. Modern variants often include double extortion: they steal your data before encrypting it, then threaten to leak it if you don't pay.

According to the FBI's Internet Crime Complaint Center (IC3), ransomware complaints have increased year over year, with reported losses climbing into the hundreds of millions. And those are just the incidents that get reported. The real number is far higher.

So why does it keep working? Because the attack vectors exploit fundamental weaknesses in how organizations operate — email, remote access, software trust, and human behavior. Let's break down each one.

Vector 1: Phishing — Still the #1 Way Ransomware Spreads

The Verizon Data Breach Investigations Report (DBIR) has consistently found that phishing and social engineering remain the top initial access vectors for data breaches, and ransomware is no exception. A well-crafted email with a malicious attachment or link is all it takes.

Here's what actually happens: an employee receives an email that looks like an invoice, a shipping notification, or a message from IT. They click the link. A loader executes. Within minutes, the threat actor has a foothold on your network.

Why Phishing Simulations Matter More Than Policies

I've seen organizations with 50-page acceptable use policies get hit because nobody ever tested whether employees could actually spot a phishing email. Policies don't build muscle memory — practice does. Running regular phishing awareness training for your organization is one of the highest-ROI security investments you can make.

Modern phishing simulation platforms let you send realistic test emails, track who clicks, and deliver targeted training to repeat offenders. It's not about shaming people — it's about building reflexes.

Vector 2: Remote Desktop Protocol (RDP) Exploitation

RDP exposed to the internet is like leaving your front door wide open with a sign that says "come in." Threat actors use tools like Shodan to scan for open RDP ports, then brute-force or use stolen credentials to log in. Once they're in, they have direct access to deploy ransomware manually.

During the COVID-19 shift to remote work, exposed RDP endpoints skyrocketed. Many organizations never cleaned up those configurations. If you're running RDP on port 3389 facing the public internet in 2026, you are a target. Full stop.

The Fix Is Straightforward

Put RDP behind a VPN or a zero trust network access (ZTNA) solution. Enforce multi-factor authentication on every remote access point. Monitor for failed login attempts. These aren't advanced techniques — they're table stakes.

Vector 3: Software Vulnerabilities and Unpatched Systems

The Kaseya VSA attack in 2021 demonstrated how ransomware spreads through software supply chains. The REvil group exploited a vulnerability in Kaseya's remote management software to push ransomware to hundreds of managed service providers and their downstream clients simultaneously. One vulnerability, thousands of victims.

CISA's Known Exploited Vulnerabilities (KEV) catalog exists for exactly this reason. It tracks vulnerabilities that are actively being used by threat actors in the wild. If you're not cross-referencing your asset inventory against the KEV catalog on a regular cadence, you're flying blind.

Patch Management Isn't Optional

Every ransomware incident I've investigated involving an unpatched vulnerability had the same backstory: the patch was available weeks or months before the attack. The team just hadn't gotten to it. Automated patch management and a risk-based prioritization framework aren't luxuries — they're survival requirements.

Vector 4: Credential Theft and Access Brokers

There's an entire underground economy built around selling stolen credentials. Initial access brokers (IABs) compromise organizations and then auction off that access to ransomware operators. Your credentials might be on a dark web marketplace right now, harvested from a previous data breach or an infostealer malware infection.

Credential stuffing attacks — where attackers use leaked username/password pairs against your systems — succeed because people reuse passwords. It's that simple.

Multi-Factor Authentication Blocks Most Credential Attacks

MFA isn't perfect, but it stops the vast majority of credential-based intrusions. According to Microsoft, MFA blocks over 99.9% of automated account compromise attacks. If you haven't rolled out MFA across your entire organization — especially for email, VPN, and admin consoles — you're leaving the door cracked open for ransomware operators.

Vector 5: Malicious Websites and Drive-By Downloads

Threat actors compromise legitimate websites or stand up convincing lookalikes that deliver malware through browser exploits or deceptive download prompts. An employee researching a vendor, reading industry news, or downloading what they think is a legitimate tool can trigger an infection chain.

Watering hole attacks — where adversaries compromise sites frequented by a specific target group — are particularly effective because the victim trusts the source. This is another reason why security awareness training matters. Your team needs to understand that even familiar websites can be weaponized.

Building that instinct starts with solid cybersecurity awareness training that covers real-world scenarios, not just checkbox compliance.

Vector 6: Removable Media and Insider Threats

USB drives left in parking lots. Infected external hard drives shipped from compromised vendors. Even a well-meaning employee plugging in a personal device. Physical media attacks are less common than phishing, but they still happen — and they bypass your email security entirely.

In 2022, the FBI warned that the FIN7 cybercrime group was mailing malicious USB drives to organizations, disguised as gift cards from Amazon or COVID-19 guidance from the Department of Health and Human Services. If it sounds absurd, that's exactly why it works.

How Does Ransomware Spread Once It's Inside?

Getting initial access is just step one. Here's what happens next in a typical ransomware attack chain:

  • Lateral movement: The threat actor uses tools like Cobalt Strike, Mimikatz, or living-off-the-land binaries (LOLBins) to move across your network.
  • Privilege escalation: They target domain admin credentials to gain maximum control.
  • Data exfiltration: Before encrypting anything, they steal sensitive data for double extortion leverage.
  • Defense evasion: They disable antivirus, delete shadow copies, and clear event logs.
  • Deployment: They push the ransomware payload across as many systems as possible, often via Group Policy or PsExec.

This entire sequence can happen in hours. In some cases, I've seen threat actors sit inside a network for weeks, mapping everything before detonating. Zero trust architecture — where every user and device must continuously verify — is the best framework for limiting lateral movement.

What Should You Do Right Now?

Understanding how ransomware spreads is the first step. Here's your immediate action list:

  • Train your people: Phishing simulation and security awareness training are non-negotiable. Human error is the top initial access vector.
  • Enforce MFA everywhere: Email, VPN, cloud apps, admin panels — every login that matters.
  • Patch aggressively: Cross-reference CISA's KEV catalog weekly. Prioritize internet-facing systems.
  • Eliminate exposed RDP: Audit your attack surface. If RDP is reachable from the internet, fix it today.
  • Segment your network: Flat networks are ransomware playgrounds. Limit blast radius with proper segmentation.
  • Back up and test restores: Offline, immutable backups. Test them quarterly. If you haven't tested a restore, you don't have a backup — you have a hope.

The Real Cost of Ignoring These Vectors

IBM's Cost of a Data Breach Report has pegged the global average cost of a data breach at $4.88 million. Ransomware incidents routinely exceed that figure when you factor in downtime, legal fees, regulatory fines, and reputational damage.

Every vector I've described above is preventable. Not with exotic technology or massive budgets — with discipline, training, and basic hygiene. The organizations that get hit in 2026 won't be the ones that lacked tools. They'll be the ones that skipped the fundamentals.

Start with your people. Understand the attack vectors. Build layers of defense. That's how you stop ransomware before it starts.