All of the following can be indications of a ransomware attack EXCEPT?

An increased amount of spam email is a common delivery vector for ransomware (e.g., via malicious attachments or links) but is not an indication that a ransomware attack is actively occurring on a system. The other options are direct symptoms of a ransomware infection in progress. Inaccessible files result from encryption, high CPU activity is caused by the resource-intensive encryption process, and suspicious network traffic is the malware communicating with its command-and-control (C2) server.

A. The inability to access files is the primary and most obvious indicator of a ransomware attack, as the malware's purpose is to encrypt them.
C. The encryption process is computationally demanding, which often leads to a noticeable and sustained increase in CPU and disk activity.
D. Ransomware often communicates with an attacker's C2 server to receive encryption keys and send status updates, creating detectable suspicious network traffic.

1. Cybersecurity and Infrastructure Security Agency (CISA). (2020). Ransomware Guide. U.S. Department of Homeland Security. The guide lists "Indicators of a ransomware attack" which include "unusual outbound network traffic" and "high CPU and disk activity for no apparent reason." It lists phishing emails as a common infection vector, not an indicator of active infection. (Pages 6, 11).

2. ENISA (European Union Agency for Cybersecurity). (2021). ENISA Threat Landscape 2021. The report details the ransomware lifecycle, where indicators of compromise (IoCs) include file encryption, C2 communication, and performance degradation, while phishing/spam is categorized as an initial access technique. (Section 5.1).