Even in the event that your friend is correct, it sounds like the author(s) of the new mod have not yet released it, so they are not yet committing copyright infringement for failure to attribute any Apache-licensed work they used. It sounds like they may have briefly violated the original author's copyright by releasing their source code accidentally, but cured that violation immediately. Assuming they do release their mod in source or binary form without attributing the upstream author, it is up to that author to prove the use of Apache-licensed code.
You have a copy of the source, which could be very helpful in determining infringement, and I think you are correct in not sharing any part of that source code without the new developers' consent: it surely contains original copyrightable authorship, even in the event that it also has infringing material. The GitHub terms of service permit you to "view" public repos on GitHub, so you were not wrong to copy the repository into your local computer memory (which is how "viewing" works in an online context), but you are surely not permitted to share it further. You could begin by using tools for detecting code plagiarism; this could allow you to say, "Plagiarism Tool(s) X found YY% similarity," giving mechanical weight to your claims without sharing the other developers'code.
It is possible the downstream devs misunderstand the license and are afraid that admitting use of Apache-licensed code will require them to license their own code in some particular way. Compliance with the Apache 2.0 license is extremely simple and does not interfere with the new developers' plan to offer a closed-source iteration of your friend's original mod. (Apache 2 is not a copyleft license; it does not require source disclosure!) Therefore, I would focus on explaining that your request for attribution is required by the code they've used but also practically harmless. They simply need to list the original author, unobtrusively, as one of several contributors to the project, by preserving their copyright statement and including a copy of the Apache license, but do not need to license their own code in any particular way.
If you come to them highlighting the simplicity of your request and with specific evidence of plagiarism, but they go on to publish the mod without attribution, I would probably hire a lawyer who could draft a cease-and-decist letter and who could more clearly outline how you may and may not use the now-removed source code to prove infringement. In the event their mod is hosted in the U.S., you could also issue a DMCA takedown request to whatever provider is hosting their mod. However, they could make a restoration counter-request, at which point you'd be back to contacting a lawyer.