Ransomware operators rely less on email and more on criminal groups for initial access into target networks. Only one strain accounts for 95% of ransomware as a first-stage email payload between 2020 and 2021, researchers say. The rise of wormable and human-operated threats gave them the power to become more disruptive. Researchers tracked at least 10 attack groups acting as initial access facilitators or likely ransomware affiliates. They’re also using downloaders, such as Buer Loader and Baza Loader, which are commonly used for ransomware.”]