The surface of the heist was presumably started in late 2013 when a A.T.M.
in Kiev was exhibiting some strange behavior when it started dispensing cash at seemingly random times of day.
No card or button on the A.T.M.

Kaspersky labs, a Russian cyber-security firm was called to investigate the A.T.M.
It goes without saying Officials at the White House and the F.B.I.
It is suspected that this was not a nation state, but rather a specialized group of cyber criminals.

When the targeted bank employee clicked on the email, they inadvertently downloaded malicious code.
In doing this they could stage everything to look like a normal, everyday transaction.
cash dispensing to terminals where the associates would be waiting.
Then $9,000 would be transferred outside the bank.
Some of the numbers reported by Kaspersky on the effectiveness of the hacks were $7.3 million through A.T.M.
withdrawals alone and $10 million from the exploitation of its accounting system.
The level of the sophistication of this heist was Oceans 11 on steroids.
source: www.techworm.net