Ransomware crews now steal data before they encrypt, pressure victims from several sides, and favor mid-market targets. Here is how the tactics changed and what defenders should do first.