It is unclear whether this means that “computer-hacking tools” were used by the trio or if they were only there to collect the funds. It is common in cash-out schemes for a hacker, or group of hackers, to compromise ATMs and then hire others to stand by the ATMs while they remotely control the ATM to make it dispense large sums of money. In past incidents involving hacking ATMs, bank employees were first targeted with malware, giving attackers remote backdoor access to workstations. After gaining initial access, attackers often steal credentials for administrator accounts and abuse those accounts to move laterally to other workstations or servers to eventually compromise the ATMs. It is important to closely monitor workstations and servers for potential attacker behaviors, stopping them before attackers have a chance to reach their objective. More information on this incident can be found at https://www.rferl.org/a/two-ukrainians-jailed-in-bosnia-on-suspicion-of-stealing-1-5-million-from-russia-s-sberbank-atms/30425361.html