The Snatch ransomware, that attacks Windows systems, appears to have incorporated a new trick into its routine by rebooting PCs into safe mode before beginning the encryption of files on an infected system, the security firm Sophos claims.