Student accused of hacking CABS, fraudulently moving US$1.1million

A 24-year-old final-year Computer Science student at Midlands State University (MSU) has appeared before the Harare Magistrates' Court facing allegations of hacking into the computer systems of CABS and facilitating fraudulent transactions worth more than US$1.1 million.

Sabelo Malunga is accused of compromising the bank's IT infrastructure during and after his attachment as an IT intern between November last year and February 23.

The prosecution alleges that on January 23, Malunga used a CABS-issued laptop to download SUPREMO, a remote-access software application, without authorisation.

He allegedly concealed the programme among system files to prevent it from being detected.

According to the State, Malunga continued accessing CABS systems remotely after his internship had ended. He allegedly used the software to bypass internal security controls and initiate fraudulent ZIPIT and VISA transactions.

The alleged cyber breach was discovered on March 27, after VISA detected two suspicious international ATM transactions.

Although CABS moved to block the affected accounts, the bank had allegedly already suffered losses of US$210,500.

Further investigations on April 13 reportedly uncovered multiple malware infections on the bank's servers.

Investigators allegedly identified 1,911 fraudulent ZIPIT transactions valued at US$925,679. The funds were reportedly transferred into accounts linked to EcoCash, InnBucks, CBZ and Ecobank.

Following the discovery, CABS engaged South African digital forensics firm MWR to conduct an investigation and remove the malicious software from its systems.

The forensic investigation allegedly traced the cyber intrusion to Malunga.

The State alleges that the malware enabled Malunga to circumvent the bank's authorisation mechanisms, create fictitious transfers and generate fraudulent telegraphic transfers, allowing funds to be diverted from the financial institution.

The total alleged loss suffered by CABS has been placed at US$1,136,179, with the prosecution stating that none of the funds had been recovered at the time of the court proceedings.

Malunga is facing a charge of hacking. He was remanded in custody and is expected to appear before the court on August 31 for a bail hearing.

The allegations have not been tested in court, and Malunga remains innocent until proven guilty.