Ransomware down this year but there's a catch