Ransomware-dropping malware has swapped phishing for a new attack route