The financially motivated group is combining vishing, IT impersonation, and in-person office intrusions to steal data and extort victims.