Using a trojan malware with the Russian name, Tyupkin, hackers made cash withdrawals without so much as accessing bank accounts.