Ransomware arrived in one of the email honeypot accounts last week, disguised using the well-worn electronic fax "Incoming Fax Report" trope. We don't usually see this kind of malware arrive as a direct delivery; Typically, ransomware arrives as a payload delivered by some other piece of malware, or an exploit kit.
more here........https://www.bluecoat.com/security-blog/2015-03-02/cryptolocker-delivered-fax-still-bad-ever
more here........https://www.bluecoat.com/security-blog/2015-03-02/cryptolocker-delivered-fax-still-bad-ever