What does a ransomware email look like?
Ransomware emails can camouflage themselves as legitimate emails better than many expect. You might see an email that appears to come from your organization’s CEO with a hyperlink that claims to be for a gift card purchase, a training course, or even a meeting invitation, but the link is actually malware.
Among the most obvious signs of ransomware are:
- Suspicious or unrecognized sender email
- Obvious grammar or spelling errors
- Abrupt and/or unusual requests to purchase gift cards
- Inconsistent company logo or email signature
Ransomware email examples
Phishing scams
Phishing scams trick victims into clicking on malicious links and/or revealing confidential or sensitive information, such as a password. A phishing email typically disguise itself as coming from someone within the victim’s organization.
Ryuk
Ryuk is a type of ransomware that is usually deployed in phishing scams. Once cyberattackers gain access to the target organization’s network, they encrypt important files, demanding a ransom to decrypt the files.
Learn more about Ryuk.
Maze
Maze was one of the first RaaS (Ransomware as a Service) models which even had its own “customer service” page that helped victims of its ransomware attacks figure out how to pay ransom and regain access to their files.
Maze was commonly deployed via phishing attacks, but there were also many instances where Maze preyed on weak passwords and successfully infiltrated organizations using brute-force attacks.
Learn more about Maze.
The evolving threat of email ransomware
Though ransomware variants like Maze and Ryuk are relatively well-understood, and Maze allegedly shut down in 2020, there are plenty of emerging threats that have been emerging suddenly to extort all kinds of organizations. New ransomware threats are often based on previous ransomware models, and sometimes operated by the same cyber criminal affiliates—often under different names.
