Cybercriminals are using Dharma ransomware-as-a-service (RaaS) to attack small & medium-sized businesses (SMBs), British cybersecurity company Sophos says.