With an immature codebase and a "rather chaotic encryption scheme" prone to failure, the group targets small businesses with custom malware.