--- title: "After a Hiatus Phishing Emails Once Again Being Used to Deliver Ransomware | DuoCircle" description: "For the longest time, the number one delivery mechanism for ransomware was a phishing email. As much as 91% of ransomware was delivered that way." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/" --- Quick Answer Email-borne ransomware is back. After attackers shifted toward exposed RDP and public-facing servers, researchers at Proofpoint reported hundreds of thousands of ransomware-laden phishing messages per day in mid-2020, including revivals of older families, often using coronavirus-themed lures. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=After%20a%20Hiatus%20Phishing%20Emails%20Once%20Again%20Being%20Used%20to%20Deliver%20Ransomware&url=undefined%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F&title=After%20a%20Hiatus%20Phishing%20Emails%20Once%20Again%20Being%20Used%20to%20Deliver%20Ransomware "Share on Reddit") [ ](mailto:?subject=After%20a%20Hiatus%20Phishing%20Emails%20Once%20Again%20Being%20Used%20to%20Deliver%20Ransomware&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F "Share via Email") ![Phishing Emails](https://media.mailhop.org/duocircle/images/2020/07/sendgrid-alternative-5544.jpg) For the longest time, the number one delivery mechanism for ransomware was a **phishing email**. As much as [91%](https://www.darkreading.com/endpoint/91--of-cyberattacks-start-with-a-phishing-email/d/d-id/1327704) of ransomware was delivered that way. And then things changed. According to an [article](https://www.zdnet.com/article/ransomware-attacks-that-start-with-phishing-emails-are-suddenly-back-in-fashion-again/) on ZDNet, “in recent years, _attackers have successfully pivoted to using remote ports, insecure public-facing servers and other vulnerabilities in enterprise networks to **encrypt entire networks**_, often demanding hundreds of thousands of dollars in payment to release the data again.” For a short time, _hackers changed the way they deployed ransomware_. Nobody really knows why, although it may be due to the increase in the number of people working remotely. But what we do know is that after a short hiatus, hackers are once again returning to their favorite way of delivering [ransomware: phishing emails](/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/). From ZDNet, “_Ransomware attacks via email are on the rise again, with several new and familiar forms of ransomware recently being distributed with the aid of malicious payloads in **phishing messages**_. In recent weeks, researchers at Proofpoint have seen a rise in the number **ransomware attacks** being distributed by email, including one from ransomware that hasn’t been active in years, with crooks sending out hundreds of thousands of messages every day. _The email attacks use a variety of lures to trick people into opening them_, including subject lines related to coronavirus.” [![email-based ransomware](https://media.mailhop.org/duocircle/images/2020/07/hosted-email-server-5544.jpg)](/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/attachment/hosted-email-server-5544) They’re back, but not yet in full force. “While the number of **email-based ransomware** attacks is still small compared to 2016 and 2017, when the likes of Locky, Cerber and GlobeImposter were being distributed in massive volumes of tens of millions, _the recent rise in email attacks demonstrates how flexible cyber criminals can be._” We can expect the numbers to rise from here on. It was smart to deploy **cloud-based email security** before to protect against phishing attacks and ransomware and it’s smart once again. If you haven’t already deployed [phishing protection](/email/phishing-protection) software in your organization, now’s the time. And **Phishing Protection** from DuoCircle is the solution for all cost-conscious companies who want to protect their employees without breaking the bank. Since it’s cloud-based, _Phishing Protection requires no hardware, no software, no maintenance and no upfront costs_. It also works with every major email provider, sets up in 10 minutes and comes with **real-time link click protection**. If you didn’t get your email security right the first time around, you can make up for it today with Phishing Protection from [DuoCircle](/). Try it **free for 60 days**. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F) [ ](https://twitter.com/intent/tweet?text=After%20a%20Hiatus%20Phishing%20Emails%20Once%20Again%20Being%20Used%20to%20Deliver%20Ransomware&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fafter-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware%2F) Copy Related Articles - [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg) AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/) - [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg) 10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/) - [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg) 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/) - [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg) 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ## Related Articles [ Phishing 11m AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[ Phishing 5m 10 Applications of ChatGPT that Hackers Are Already Exploiting May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[ Phishing 4m 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[ Phishing 9m 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"After a Hiatus Phishing Emails Once Again Being Used to Deliver Ransomware","description":"For the longest time, the number one delivery mechanism for ransomware was a phishing email. As much as 91% of ransomware was delivered that way.","url":"https://www.duocircle.com/blog/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/","datePublished":"2020-07-04T22:12:13.000Z","dateModified":"2025-05-13T14:48:00.000Z","dateCreated":"2020-07-04T22:12:13.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/"},"articleSection":"phishing-protection","keywords":"","wordCount":409,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/07/sendgrid-alternative-5544.jpg","caption":"Phishing Emails","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"After a Hiatus Phishing Emails Once Again Being Used to Deliver Ransomware","item":"https://www.duocircle.com/blog/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"After a Hiatus Phishing Emails Once Again Being Used to Deliver Ransomware","item":"https://www.duocircle.com/blog/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"After a Hiatus Phishing Emails Once Again Being Used to Deliver Ransomware","description":"For the longest time, the number one delivery mechanism for ransomware was a phishing email. As much as 91% of ransomware was delivered that way.","url":"https://www.duocircle.com/blog/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/","datePublished":"2020-07-04T22:12:13.000Z","dateModified":"2025-05-13T14:48:00.000Z","dateCreated":"2020-07-04T22:12:13.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/after-a-hiatus-phishing-emails-once-again-being-used-to-deliver-ransomware/"},"articleSection":"phishing-protection","keywords":"","wordCount":409,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/07/sendgrid-alternative-5544.jpg","caption":"Phishing Emails","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```