The attacker’s latest moves reveal a renewed effort to hide funds, leaving investigators with fewer ways to follow the money.