Some of their attacks involve stealing money, but not all of them. Regardless, that argument is circumstantial at best. Look at the report https://www.operationblockbuster.com/wp-content/uploads/2016... . There was re-use of malware, C&C infrastructure, and RSA certificates, that is hard evidence.