Sabelo Malunga: CABS Hacking Charges Allege $1.1M Zimbabwe Fraud

• Sabelo Malunga, an MSU Computer Science student, faces charges for allegedly hacking CABS systems and facilitating over US$1.1 million in fraudulent transactions.
• He is accused of downloading SUPREMO remote access software onto a CABS laptop without permission during his IT internship and continuing unauthorized access afterward.
• The alleged breach was discovered in March after suspicious VISA transactions, leading to the identification of 1,911 fraudulent ZIPIT transactions totaling US$925,679.
• Forensic investigations traced the cyber intrusion to Malunga, who is alleged to have circumvented bank controls to divert funds, with no money recovered to date.
• Malunga was remanded in custody and was scheduled for a bail hearing on August 31, facing a charge of hacking.

The total alleged loss to CABS now stands at US$1,136,179, with no funds recovered to date.

A final-year Computer Science student from Midlands State University (MSU), Sabelo Malunga, aged 24, has been brought before the Harare Magistrates Court on serious charges related to the alleged hacking of CABS' computer systems. He stands accused of orchestrating fraudulent transactions that collectively amount to more than US$1.1 million. The prosecution's case centers on allegations that Malunga compromised the financial institution's information technology infrastructure during his tenure as an IT intern, which spanned from November of the previous year until February 23, and continued even after his internship concluded.

Specifically, it is alleged that on January 23, Malunga utilized a CABS-issued laptop to download SUPREMO, a remote-access software application, without proper authorization. He then reportedly concealed this program within system files, an action purportedly designed to evade detection. Following the end of his internship, Malunga is accused of maintaining unauthorized remote access to CABS systems, leveraging this access to bypass internal controls and initiate a series of fraudulent ZIPIT and VISA transactions. This alleged Sabelo Malunga CABS hacking Zimbabwe incident highlights significant vulnerabilities.

The extent of the alleged breach began to surface on March 27, when VISA flagged two suspicious international ATM transactions. Although CABS promptly moved to block the compromised accounts, the bank had already incurred losses totaling US$210,500. Subsequent investigations on April 13 revealed multiple malware infections across the bank's servers. These inquiries uncovered 1,911 fraudulent ZIPIT transactions, valued at US$925,679, with funds reportedly diverted into accounts linked to various platforms including EcoCash, InnBucks, CBZ, and Ecobank. The total alleged loss to CABS now stands at US$1,136,179, with no funds recovered to date.

In response to the escalating crisis, CABS engaged MWR, a digital forensics company based in South Africa, to conduct a thorough investigation and eradicate the malicious software from its systems. The forensic analysis reportedly traced the cyber intrusion directly back to Malunga, leading to his appearance in court. He is currently facing a charge of hacking, a serious offense under Zimbabwe cyber law enforcement.

The State contends that the malware allegedly deployed by Malunga provided him with the capability to circumvent CABS' established authorization mechanisms. This alleged access allowed him to create fictitious transfers and generate fraudulent telegraphic transfers, thereby enabling the diversion of substantial funds from the financial institution. The CABS cyber fraud charges Zimbabwe underscore the sophisticated nature of the alleged scheme. Malunga was remanded in custody and was scheduled for a bail hearing on August 31.

This MSU student bank hacking case serves as a critical illustration of the persistent threat of cybercrime facing financial institutions. The alleged actions of Sabelo Malunga, particularly his continued unauthorized access post-internship and the use of SUPREMO remote access CABS systems, expose potential weaknesses in internal security protocols and access management. The substantial sum of over US$1.1 million in alleged losses, none of which has been recovered, highlights the severe financial repercussions of such breaches.

The incident also points to the interconnectedness of the Zimbabwean financial ecosystem, with fraudulent funds allegedly channeled through multiple banking and mobile money platforms. This complexity can complicate recovery efforts and necessitates a robust, collaborative approach to cybersecurity across the sector. The case underscores the urgent need for Zimbabwe financial institution cybercrime prevention strategies to be continuously reviewed and strengthened, especially regarding the monitoring of privileged access and the detection of insider threats.

This case serves as a stark reminder for compliance officers and legal counsel at financial institutions in Zimbabwe to urgently review and bolster their internal cybersecurity protocols, particularly concerning remote access software and insider threat detection, to mitigate significant financial and reputational risks.

Source: Original reporting via New Zimbabwe.