My guess would be that the people making the withdrawals are members of some darknet forum who paid for credentials to be delivered at specific time. I don’t see how the person/people orchestrating this could get around the massive logistical problems of getting a bunch of thieves to send you some of their stolen cash.
Edit: This is just a guess, and I see that @jamesnsc and others have presented alternate theories. I could swear I’ve heard of heists like this taking place over a huge geographic area, and when I read “1,400 ATMs” I assumed that was true, which would lead me to believe it was a disorganized attack.
Having read up on it, it seems I was probably wrong and the cashers tend to be smaller groups who do send back some money after the fact. I guess you would make a lot more money if you can organize something like that.
