Ransomware groups switch to stealthy attacks and long-term access