Learning from Baltimore's disaster, Florida city will pay criminals $600,000 to get free of ransomware attack

What is the current vector for these attacks? Is someone clicking on a phishing email, with a link to a site that installs the malware?

Is there any other way than that, that this is still spreading?