How Ransomware has Evolved to Avoid Detection | Fireglass:
"This is how it works: the victim inadvertently runs the malware, such as by visiting a malicious website, opening a malicious email attachment or installing an infected application. The ransomware then, encrypts files on the infected computer using a random, one-off encryption key which is sent to the perpetrator."