Stay Ahead of Ransomware - Initial Access via Evolving Social Engineering

Why It Matters

ClickFix and Teams vishing are rapidly becoming top ransomware entry points, and detecting their forensic artifacts early can prevent costly breaches.

Key Takeaways

• ClickFix attacks surged 517% in 2025, targeting all sectors
• Microsoft Teams vishing now a common ransomware entry vector
• Run-MRU registry key logs malicious Windows R commands
• PowerShell logging crucial for detecting post‑execution payloads
• User education on clipboard hijacking reduces initial‑access risk

Summary

The April 2026 SANS "Stay Ahead of Ransomware" livestream focused on evolving social‑engineering techniques that grant attackers initial access. Hosts Ryan Chapman and Mary Degrazia examined two prominent vectors: the ClickFix scheme, which lures users to a fake capture page that hijacks the clipboard and executes PowerShell via the Windows R dialog, and Microsoft Teams‑based vishing, where threat actors impersonate trusted contacts to deliver malicious links that trigger remote‑access tools.

Data presented highlighted a dramatic 517 % rise in ClickFix incidents during 2025, now rivaling traditional RDP and VPN exploits. The presenters referenced Coveware and Unit 42 reports showing the technique’s spread across high‑tech, manufacturing, real‑estate, and other industries. They demonstrated how the Run‑MRU registry key preserves the malicious command history, and emphasized that PowerShell logging—when enabled—captures the subsequent payload execution, providing forensic breadcrumbs.

Mary illustrated a live‑recorded scenario: a user receives a trusted‑friend email, follows a verification link, and is prompted to press Windows R and paste a clipboard‑copied PowerShell command. The victim’s repeated attempts generate multiple Run‑MRU entries and email threads, which investigators can trace. Ryan complemented this with a walkthrough of Teams‑based phishing, showing how quick‑assist and remote‑monitoring tools are abused after a successful vishing call.

The discussion underscored the need for proactive defenses: enforce strict PowerShell logging, monitor Run‑MRU registry activity, and conduct regular user awareness training on clipboard hijacking and Teams vishing. Organizations that harden remote‑access services and educate staff can significantly lower the probability of ransomware deployment originating from these social‑engineering tactics.

Original Description

For years, Initial Access in the world of Ransomware and Cyber Extortion was a battle between phishing, Remote Desktop Protocol (then just "remote access"), and software vulnerability exploitation. While those three remain key players, social engineering tactics have evolved and taken on a more substantial share of the initial access market. Ransomware campaigns are more commonly involving threats such as the ever-evolving ClickFix along with Teams-based social engineering tactics that often involve QuickAssist and/or RMM threats. Join Ryan and Mari as they walk you through example attacks, live with hands-on keyboard analysis of such attacks, and discuss tips and tricks related to prevention, detection, and response for these initial access methods.