What you'll learn in this article
Learn everything there is to know about ransomware emails, what to do if you get a ransomware email and how Mimecast can help you protect your organization from ransomware attacks.
- Ransomware often enters through phishing emails, so employee awareness, advanced email security, and multi-factor authentication are essential defenses.
- Regular software updates, strong backup procedures, limited user access, and endpoint protection help reduce vulnerabilities and contain attacks.
- Segmenting networks, monitoring traffic, and having a tested incident response plan create a layered, resilient defense against ransomware.
What does a ransomware email look like?
Ransomware emails can camouflage themselves as legitimate emails better than many expect. You might see an email that appears to come from your organization’s CEO with a hyperlink that claims to be for a gift card purchase, a training course, or even a meeting invitation, but the link is actually malware.
Among the most obvious signs of ransomware are:
- Suspicious or unrecognized sender email
- Obvious grammar or spelling errors
- Abrupt and/or unusual requests to purchase gift cards
- Inconsistent company logo or email signature
Ransomware email examples
Phishing scams
A phishing scam tricks victims into clicking on malicious links and/or revealing confidential information, such as a password. Phishing emails typically disguise themselves as coming from someone within the victim’s organization.
Ryuk
Ryuk is a type of ransomware that is usually deployed in phishing scams. Once cyberattackers gain access to the target organization’s network, they encrypt important files, demanding a ransom to decrypt the files.
Learn more about Ryuk.
Maze
Maze was one of the first RaaS (Ransomware as a Service) models which even had its own “customer service” page that helped victims of its ransomware attacks figure out how to pay ransom and regain access to their files.
Maze was commonly deployed via phishing attacks, but there were also many instances where Maze preyed on weak passwords and successfully infiltrated organizations using brute-force attacks.
Learn more about Maze.
The evolving threat of email ransomware
Though ransomware variants like Maze and Ryuk are relatively well-understood, and Maze allegedly shut down in 2020, there are plenty of emerging threats that have been emerging suddenly to extort all kinds of organizations. New ransomware threats are often based on previous ransomware models, and sometimes operated by the same cyber criminal affiliates—often under different names.
As ransomware continues to evolve, so too does cybersecurity. Mimecast will always be there to help protect your organization protect against ransomware attacks and keep you informed about new potential threats. Enter your email to receive updates on the latest trends in cybersecurity and how you can keep your organization in the loop.
