A financially motivated threat group is using a reworked version of its known backdoor to deploy the Noberus ransomware.