Two Convicted Over Attempted UBA Zambia Cyber Attack

The National Prosecution Authority has secured the conviction of two men over an attempted cyberattack targeting the computer systems of United Bank for Africa (UBA) Zambia.

The two, UBA Zambia employee Chisomo Zulu and Jesh Mukuka, were convicted by the Subordinate Court sitting in Lusaka for attempting to interfere with a computer system without lawful authority, contrary to Section 55(2) read with Section 49(2) of the Cyber Security and Cybercrimes Act No. 2 of 2021.

The prosecution presented CCTV footage, digital forensic evidence, electronic communications, security logs and statements obtained during investigations.

Court heard that CCTV footage showed Mukuka handing over a package to Megan Chishala, who later delivered it to Zulu at about 15:32 hours. Zulu was subsequently seen returning to his workstation and repeatedly bending beneath his desk.

Security officers later discovered unauthorized devices connected to the computer, including an MTN MiFi, an HDMI device and a mini PC.

The Court heard that UBA’s security systems detected suspicious commands originating from Zambia and directed towards the bank’s systems in Lagos, Nigeria. The activity was intercepted before the intended interference could be completed.

An analyst testified that the mini PC had accessed the UBA network, while phones seized from the accused contained communications relating to the equipment.

The Court found that the prosecution had not established the completed offence under Section 49(2), as there was no evidence that data had been modified, destroyed or rendered ineffective. However, it found that the evidence established an attempt beyond reasonable doubt.

Relying on Section 55(2) and the decided case of Wina Lubinda v The People, the Court found that the conduct had gone beyond mere preparation, with equipment obtained, delivered, connected to the workstation and used to access and scan the bank’s network.

The Court also found that the circumstantial evidence—including the package delivery, CCTV footage, the accused’s movements, unauthorised equipment, forensic findings, phone communications and network activity—formed a coherent chain linking the two accused to the attempted operation.

No data or financial loss was established, as the bank’s security controls prevented the activity from being completed.

The matter was prosecuted by Senior Public Prosecutor Hastings Sichone, while the defence was mounted by M. B. Ayami of the Legal Aid Board.

The case was heard before Honourable Sylvia Munyinya Okoh, who has since been appointed a Judge of the High Court.

The two men have been convicted, while sentencing remains pending.

The National Prosecution Authority says it will provide further updates as the proceedings continue.