This old ransomware variant is back - with sneaky new tricks