A MIDLANDS State University (MSU) final-year Computer Science student has appeared before the Harare Magistrates Court facing allegations of hacking into CABS’ computer systems and facilitating fraudulent transactions amounting to more than US$1.1 million.
Sabelo Malunga (24) is accused of compromising the bank’s information technology infrastructure during and after his attachment as an IT intern between November last year and February 23.
The prosecution alleges that on January 23, Malunga used a CABS-issued laptop to download SUPREMO, a remote-access software application, without permission.
He allegedly concealed the programme among system files in an effort to prevent it from being detected.
According to the State, Malunga continued gaining unauthorised remote access to CABS systems even after his internship had ended. He allegedly used the malware to circumvent internal controls and initiate fraudulent ZIPIT and VISA transactions.
The alleged breach came to light on March 27 after VISA detected two suspicious international ATM transactions.
Although CABS moved to block the affected accounts, the bank had allegedly already suffered losses of US$210,500.
Further investigations conducted on April 13 reportedly uncovered several malware infections on the bank’s servers.
Investigators allegedly identified 1,911 fraudulent ZIPIT transactions valued at US$925,679. The funds were reportedly channelled into accounts linked to EcoCash, InnBucks, CBZ and Ecobank.
Following the discovery, CABS engaged South African digital forensics company MWR to conduct a detailed investigation and eliminate the malicious software from its systems.
Forensic investigations allegedly traced the cyber intrusion to Malunga.
The State alleges that the malware gave Malunga the ability to circumvent the bank’s authorisation mechanisms, create fictitious transfers and generate fraudulent telegraphic transfers, enabling him to divert funds from the financial institution.
The total alleged loss suffered by CABS has been put at US$1,136,179, with no money recovered to date.
Malunga is facing a charge of hacking. He was remanded in custody and is expected to appear in court today, August 31, for bail hearing.
