Ransomware today is distributed mostly via emails or the web. Emails will remain a major vector; spammers have honed the art of building botnets that can be used to distribute the campaign emails and if a targeted attack is more desirable, emails are still a weapon of choice.

As for the web, some aspects of it will continue to decrease, such as, for example, the use of exploit kits in watering hole attacks. This is due to the fact that browsers today are much more difficult to exploit. In turn, this has made the business of exploit kits much less profitable and cyber criminals are turning to other methods.

Given that some mobile devices receive updates via cellular technology, like autonomous vehicles, it is likely we will at some point start seeing the development of new distribution channels which may require hacking update servers first.