The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.