A 24-year-old Midlands State University final-year Computer Science student has appeared in court accused of using malware to siphon more than US$1.1 million from CABS through fraudulent VISA and ZIPIT transactions.
Sabelo Malunga appeared before Harare regional magistrate Francis Mapfumo facing a charge of hacking.
He was remanded in custody pending his bail hearing.
The prosecution, led by Mr Blessed Songozo, alleges that Malunga exploited access he obtained while working as an Information Technology intern at CABS between November last year and 23 February this year.
According to the State, the alleged cyber breach was uncovered in March and April after the bank detected suspicious transactions involving its VISA and ZIPIT platforms.
The court heard that on 27 March, VISA flagged two suspicious international ATM transactions involving CABS-issued debit cards.
CABS subsequently blocked the affected accounts, but the bank had already suffered an actual loss of US$210 500. Nothing has been recovered from those transactions.
On 13 April, the bank’s IT team allegedly discovered several malware infections on its servers during an internal investigation.
Further analysis allegedly showed that the malware was being used to create ZIPIT transactions and inject them directly into Zimswitch, bypassing CABS’ internal controls.
A reconciliation exercise subsequently uncovered 1 911 fraudulent ZIPIT transactions worth US$925 679 which were allegedly sent to EcoCash, InnBucks, CBZ and Ecobank.
The State said CABS then engaged South African digital forensics firm MWR to contain and remove the malware and investigate the alleged breach.
A forensic report allegedly linked Malunga to the cyberattack.
The court heard that on 23 January, while working at CABS and using a company-issued laptop, Malunga allegedly downloaded an application called SUPREMO without authorisation.
He allegedly concealed the application within system files to prevent it from being detected.
SUPREMO is a remote-access tool which the prosecution alleges allowed Malunga to remotely access CABS’ data and computer systems.
The State further alleges that Malunga continued using the application to gain unauthorised access to the bank’s systems and servers even after his internship ended on 23 February.
He is accused of installing malware that allegedly facilitated the unauthorised approval of transactions, fraudulent ZIPIT transfers through Zimswitch, fictitious transactions routed to Ecobank through an integration system and the creation of fake telegraphic transfers.
The prosecution alleges that the transactions resulted in CABS suffering an actual prejudice of US$1 136 179.
