How does ransomware spread via email?

Initial delivery: malicious attachments (macro documents, executable archives) or links to malware downloads. Social engineering convinces victims to open attachments or click links despite warnings.

Execution: opened attachments run malicious code, downloading additional payloads if needed. Links lead to exploit pages or direct downloads. Once running, ransomware encrypts accessible files.

Lateral movement: some ransomware spreads through networks after initial infection, encrypting shared drives and other accessible systems. One email can compromise entire organizations.