Ransomware continues to pose a serious problem for critical infrastructure despite a slight drop in the number of incidents, a new report says.