How does ransomware spread via email?

Initial delivery: malicious attachments (macro documents, executable archives) or links to **malware** downloads. Social engineering convinces victims to open attachments or click links despite warnings.

Execution: opened attachments run malicious code, downloading additional payloads if needed. Links lead to exploit pages or direct downloads. Once running, **ransomware** encrypts accessible files.

Lateral movement: some **ransomware** spreads through networks after initial infection, encrypting shared drives and other accessible systems. One email can compromise entire organizations.