Technical Hacking Report: Analysis of the Alleged Fraud Attempt on Real Star Security Company

Incident Overview

On September 2, a hacking attempt was made to defraud Real Star Security Company of US$190,000. The alleged perpetrators, Gladstone Mthulisi Tshabalala, Dalumuzi Masotsha Moyo, and Manase Manjovha, reportedly hacked into the company’s mobile banking credentials and attempted to fraudulently replace a SIM card associated with the company’s EcoCash mobile money account at Econet Wireless Zimbabwe. The trio was arrested after their suspicious activity was detected, and they were subsequently charged with fraud.

Alleged Fraud Methodology

1. Targeting Mobile Banking Credentials:

• The attackers first had to acquire the mobile banking credentials linked to Real Star Security Company’s EcoCash account. This likely involved compromising the complainant’s personal or corporate data, possibly through one or more of the following methods:
  • Phishing: A common tactic, where the attackers could have sent a deceptive message (SMS, email, or social engineering call) to trick the complainant into disclosing sensitive login details or clicking on a link that installs malware.
  • Credential Stuffing: If the complainant used the same or similar credentials across multiple platforms, attackers might have obtained these from previous data breaches and tested them across banking services.
  • Malware: Attackers could have installed spyware or a keylogger on the victim’s device through phishing or compromised software to capture banking credentials.

1. SIM Swap Fraud Attempt:

• Once the mobile banking credentials were obtained, the hackers attempted to conduct a SIM swap by approaching an Econet agent, Taurai Mushamba. The intention behind this was to transfer control of the mobile number (linked to EcoCash and the complainant’s banking activities) from the legitimate SIM card to a fraudulent SIM in the hacker’s possession.
• Why a SIM Swap?
  • Many mobile money and banking services (including EcoCash) use two-factor authentication (2FA) via SMS or calls to the registered mobile number. By gaining control of the phone number through a SIM swap, the hackers could intercept OTPs (one-time passwords) and authentication codes needed to authorize large transactions.
  • With the compromised mobile number in hand, they could reset the complainant’s banking account passwords or authorize transfers from the Nedbank account to accounts under their control.

1. Failed Execution Due to Suspicion:

• The hackers were caught before they could complete the fraudulent transaction. When the trio attempted to replace the SIM card at an Econet Wireless Zimbabwe agent, the agent, Taurai Mushamba, became suspicious. The fraudsters likely provided falsified identification documents to request the SIM swap, but Mushamba’s suspicion led him to alert the complainant and the police.
• Critical Failure Point:
  • The fraudsters’ plan was foiled because they relied on an external party (the Econet agent) to initiate the SIM swap. Their suspicious behavior, the falsified ID card, or inconsistencies in their request led the agent to escalate the situation before the swap could be completed.

The Role of SIM Swap in Fraud

SIM swapping is a well-known fraud technique. It allows cybercriminals to take over the victim’s mobile number by convincing or coercing a mobile service provider into issuing a new SIM card linked to the target’s phone number. With this control, the attackers can intercept any text messages or calls meant for the victim, including those required for authentication purposes. In this case:

• Gaining access to EcoCash: The EcoCash service likely used 2FA via SMS to send codes to the registered mobile number. Without the SIM card under their control, the attackers couldn’t authorize transfers or reset account passwords.
• Intercepting Nedbank Alerts: If Nedbank also used SMS alerts for large transfers or logins, the attackers would have received these alerts once they took over the number, providing them the final key to moving funds from Real Star Security’s account to their own accounts.

Investigation Findings

• Compromised Credentials: The hackers had already acquired Real Star Security’s banking credentials or mobile number details before initiating the SIM swap. The method used to acquire these details remains under investigation but likely involved phishing, social engineering, or other illicit means.
• Attempt to Bypass Security Mechanisms: The SIM swap was critical for bypassing two-factor authentication systems. By gaining control of the mobile number, the hackers intended to use it to authorize the transfer of funds from the complainant’s Nedbank account.
• Detection and Arrest: Econet Wireless Zimbabwe’s agent identified the attempted SIM swap as suspicious and alerted both the complainant and the authorities. The alleged ID used during the fraud attempt was recovered by the police, serving as key evidence in the investigation. The suspects were arrested before the SIM swap was completed, preventing the transfer of US$190,000.

Practical Implications and Lessons Learned

1. Strengthen Mobile Banking Security:

• Multi-Factor Authentication (MFA): Although 2FA via SMS is a common security measure, it is vulnerable to SIM swap attacks. Banks and mobile money services should consider using alternative MFA methods such as app-based authenticators (Google Authenticator, Authy) or biometric authentication, which are less susceptible to SIM-based attacks.

1. User Awareness:

• Users should be educated on phishing and social engineering threats to avoid inadvertently disclosing sensitive information. In particular, organizations need to train staff to recognize suspicious communication that could lead to credential theft.

1. Telecom Company Vigilance:

• SIM swaps should be treated with high suspicion, particularly when involving high-risk accounts like business or corporate accounts. Telecom companies must enforce strict identity verification procedures and flag requests for additional scrutiny if the request appears out of the ordinary.

1. ID Verification Strengthening:

• The use of falsified identification in this case highlights the need for stronger ID verification mechanisms at mobile service providers. Enhanced validation processes, such as cross-referencing multiple identification documents and employing digital ID systems, can help prevent fraudulent SIM swaps.

Conclusion

The attempted fraud on Real Star Security demonstrates the increasingly sophisticated nature of financial cybercrime in Zimbabwe and globally. By combining phishing, credential theft, and SIM swap tactics, the hackers aimed to bypass security systems and transfer large sums of money. Fortunately, the intervention of an alert telecom agent prevented the crime before it could fully unfold.

As this case highlights, a combination of robust security measures, user education, and vigilance from service providers can thwart even well-orchestrated fraud attempts.- ZimEye