In short
A ransomware email delivers the first stage of a ransomware attack: a malicious attachment, a link to a malware download, or a phishing page that steals credentials for remote access. Email controls that block it include sandboxing, attachment sanitisation, link analysis at click time, file-type blocking and removal after delivery, backed by endpoint protection and backups.
Get a quote for ransomware email protection
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
How ransomware gets in by email
Ransomware is rarely attached directly to an email. Instead, the email starts a chain that ends with an attacker inside your network:
- Malicious attachments: documents, archives, HTML files or scripts that download a loader when opened
- Links to payloads: a "view invoice" or "shared document" link to a site that downloads malware, sometimes on a legitimate file-sharing service
- Credential theft: a phishing page captures a password used for remote access, which the attacker uses later to deploy ransomware by hand
- Account takeover: a compromised mailbox sends malicious attachments to colleagues and partners, who trust them; see email account takeover
The gap between the first click and the ransomware running can be long, which is why removing the email and resetting credentials quickly matters.
Email controls that block ransomware
These controls stop the first stage, and the products we supply describe them in their own material:
| Control | What it does | Examples |
|---|---|---|
| Sandboxing | Opens unknown attachments in a safe environment and watches what they do | Defender for Office 365 Safe Attachments, Gmail Security Sandbox in supported editions, Check Point Email Security, Sophos Email, FortiMail Workspace Security |
| Attachment sanitisation | Removes risky content from documents so a clean copy can be delivered | Check Point Email Security file sanitisation |
| Link analysis at click time | Checks the destination when the link is clicked, not just at delivery | Defender for Office 365 Safe Links, Sophos Email, Proofpoint Essentials URL Defense depending on package |
| File-type blocking | Blocks attachment types that are rarely legitimate | Microsoft's common attachments filter; Gmail settings for attachments with scripts and anomalous types |
| Post-delivery removal | Removes a message from every mailbox once it is found to be malicious | Microsoft zero-hour auto purge; API products such as IRONSCALES, Vade and ThreatDown Email Security |
| Multi-scanner anti-malware | Scans attachments with several engines at the gateway | Symantec Email Security.cloud, Proofpoint Essentials |
For the wider set of email threat controls, see advanced email threat protection.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Microsoft 365 and Google Workspace settings to check
Before adding anything, make sure the protection you already have is switched on and tuned:
- Microsoft 365: keep zero-hour auto purge on, review the file types in the common attachments filter in your anti-malware policy (by default, matching messages are rejected), and if you have Defender for Office 365, apply Safe Attachments and Safe Links through the Standard or Strict preset security policies. Our Microsoft 365 phishing protection guide covers the policies
- Google Workspace: switch on the attachment protections in advanced phishing and malware protection, including encrypted attachments and attachments with scripts from untrusted senders and anomalous attachment types, and turn on the Security Sandbox if your edition supports it. See Gmail security settings
- Both: restrict who can share files externally, review which third-party apps can access mailboxes, and make sure staff have an easy way to report a suspicious message
Ransomware lures also arrive through shared files and chat. Products such as Check Point Email Security and Trend Micro extend the same scanning to collaboration apps, which matters if your teams share files through Teams, SharePoint, OneDrive, Google Drive or Slack.
The next layers: endpoint, identity and backup
Email controls reduce the risk; they do not remove it. The layers behind them decide how bad an attack gets:
- Endpoint protection: detects and stops ransomware behaviour on the device if a file gets through; see anti-ransomware software on our licensing site
- Identity security: phishing-resistant MFA and sign-in policies stop stolen credentials being used for remote access
- Backups: independent, tested backups of devices, servers and Microsoft 365 or Google Workspace data let you recover without paying
- Staff awareness: people who recognise and report suspicious emails quickly shorten the window; see ransomware awareness training on our sister site
Is ransomware email protection the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What to do if someone opens a ransomware email
If a member of staff opens an attachment or clicks a link they now suspect:
- Disconnect the device from the network, wired and wireless, and tell your IT team or provider straight away.
- Leave the device as it is for investigation rather than wiping it.
- Reset the user's password and revoke their sessions in case credentials were captured.
- Search for the same message in other mailboxes and remove every copy.
- Check the endpoint protection console for detections on that device and others.
- Follow the NCSC's guidance for organisations responding to a ransomware attack if encryption has started.
The NCSC and UK law enforcement do not encourage paying ransoms, and payment does not ensure data is returned or deleted.
Ransom and extortion emails
Some emails demand money without any malware at all. Common examples claim the sender has hacked your device, recorded you or stolen your data, sometimes quoting an old password from a public breach to seem credible.
- Do not reply, click links or pay
- If the email quotes a password, change it anywhere it is still used and turn on MFA
- Report the email through your organisation's process; you can also forward it to the NCSC's Suspicious Email Reporting Service at [email protected]
- If the email claims data has been stolen from your organisation, treat it as a possible incident and investigate before dismissing it
Our sister site explains how to report phishing in more detail.
How we help
We can help you close the email route for ransomware and make sure the layers behind it are in place. We can:
- Review attachment, link and sandboxing settings in Microsoft 365 or Google Workspace
- Recommend, license and deploy an extra email layer with sandboxing and post-delivery removal, with contents confirmed at quote
- Point you to endpoint protection and backup options across Forever Group
Ask us for a quote: Contact us about blocking ransomware by email.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What should I do with a ransomware email?
If you have not opened it, report it through your organisation's process and delete it. If you opened an attachment or clicked a link, disconnect the device from the network and tell IT straight away. For an extortion email demanding payment, do not reply or pay; report it.
How do you prevent ransomware attacks via email?
Combine sandboxing, attachment sanitisation, link checks at click time, blocking of risky file types and removal after delivery, with phishing-resistant MFA, endpoint protection, tested backups and staff who report suspicious emails quickly.
Can opening an email give you ransomware?
Reading a message on its own is rarely enough. The risk comes from opening an attachment, enabling content in a document, clicking a link that downloads a file, or entering credentials on a fake page.
Does email security stop ransomware?
It blocks one of the main ways ransomware attacks start, but not all of them. Endpoint protection, identity controls and backups are needed behind it in case a file or stolen credential gets through.
Should we pay a ransom?
The NCSC and UK law enforcement do not encourage paying. Payment does not ensure you get data back or that stolen data is deleted. Take advice, report the attack and recover from backups where you can.
Still have a question about ransomware email protection?
Ask us and a member of our team will reply by email.