Ransomware Through the Inbox: What the Locky Era Still Teaches

Years ago, a ransomware family called Locky spread by disguising itself as an ordinary Word document. Open the file, enable the content, and the encryption started. That wave is history. The lesson is not, and too many firms still file it under “old news” while running the same gaps.

The delivery changed, the pattern did not

Today’s ransomware operators rarely depend on one trick. Public guidance from CISA lists several common ways in: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infections, advanced forms of social engineering, and third parties such as managed service providers.

Notice what that list says. The fake document is only one door. If your defense is “our staff know not to open attachments”, you are defending one door out of six.

What actually limits the damage

Ransomware is a business problem that shows up as an IT problem. The firms that recover well tend to have done a few unglamorous things before the day it happened.

Backups you have restored, not just taken. Many ransomware variants go looking for reachable backups and try to delete or encrypt them. CISA’s guidance is to keep encrypted backups offline and to test them regularly. A backup nobody has tried to restore is a theory.
Phishing-resistant sign-in for email, remote access and critical systems. Stolen credentials are a common way in. Text-message codes help, but they are not the strongest option.
Patching with a priority order. Internet-facing systems and known exploited vulnerabilities go first, not last.
A tested incident response plan. A written plan nobody has rehearsed is a document, not a capability.

The mistakes that make a bad day worse

Treating the encrypted files as the whole incident. Encryption is often the last step. Attackers commonly spend time inside a network first, which can include copying data out. Restoring files does not answer the question of what else they touched.
Wiping machines before anyone looks at them. Rebuilding fast feels productive. It can also destroy the evidence you need to learn how they got in, and to confirm they are really gone.
Having no decision-maker. In the first hour, someone has to be allowed to say “disconnect that server”. Decide who that is now.
Assuming the antivirus caught it, so it is over. A quiet console is not proof of a clean network.

A practical check you can do this week

1. Pick one critical system and restore it from backup into a test location. Time it.

2. Confirm at least one backup copy cannot be reached with the same credentials used day to day.

3. List every way an outsider can sign in to your environment: email, VPN, remote desktop, vendor accounts.

4. Write down who decides to isolate systems, and how to reach them at night.

5. Ask your IT provider or team which of the entry points above they actually monitor.

None of this is exotic. It is the same discipline whether the lure is a fake document, a cloned login page, or a vendor account with too much access.

Where to start

If you are not sure which of these gaps you have, the fastest way to find out is to walk through a ransomware scenario with the people who would actually run the response. Message us to talk it through.

See how we help with incident response and security services.