Ransom demands are down, email is the top way attackers get in