It looks like UNC1069, a financially motivated threat actor active since at least 2018, is further transitioning into a mature and dangerous attacker.