In late 2025, when the Investigating Directorate Against Corruption arrested Thulani Dlomo, the elusive former ambassador to Japan and president Jacob Zuma’s personal ‘superspy’, for the alleged theft of R12m from the State Security Agency (SSA) secret fund, a reality series bigger than the Madlanga Commission appeared to be loading.
Finally, we thought, the truth about Operation Mayibuye – a multimillion-rand rogue operation within the State Security Agency (SSA) that was weaponised to neutralise political opposition to former President Jacob Zuma while serving as a conduit for untraceable cash to fuel deadly ANC factional battles – would be exposed.
This sentiment was sparked by the November 2025 arrest of Thulani Dlomo (54) – Jacob Zuma’s former self-styled “superspy” and ambassador to Japan. In an investigation led by the Investigating Directorate Against Corruption (Idac), Dlomo was charged alongside Patrick Mshothola, a project manager in the SSA’s Special Operations Unit. The pair face charges for the fraudulent withdrawal of R12-million in 2015, allegedly carried out across three tranches to fund "Operation Mayibuye".
On 1 December 2025, when Dlomo and Mshothola first appeared in court, we noted that the arrests had struck a main artery in State Capture and wondered how much, and if, it would bleed. That was then.
The Johnson bombshell
A torpedo has since hit Idac, leaving the directorate rudderless with the resignation of its head, advocate Andrea Johnson, after shocking testimony at the Madlanga Commission of alleged collusion.
Also, Idac chief investigator Dylan Perumal and senior investigators Brian Padayachee and Suneel Bellochun were suspended by Justice Minister Mmamoloko Kubayi in the aftermath of Johnson’s testimony.
Established in 2019 in the wake of the Zondo Commission of Inquiry into State Capture, part of Idac’s mandate was to examine the copious amounts of evidence and data provided to the commission. Now it appears to be limping along.
A disaster played out during the NPA’s first State Capture prosecution in 2022. Known as the “Nulane matter”, it related to R25-million fraud and the Gupta brothers short-changing emerging Free State farmers.
The high court initially dismissed the matter, stating there was “no evidence”. The collapse of the Nulane prosecution let the Guptas off the hook. The high court ruling was later overturned by the Supreme Court of Appeal, and the matter was re-enrolled.
Both the NPA and Idac hit back at the Department of Justice for restricting access to the Zondo Commission’s digital archive – an issue the department chalked up to IT maintenance glitches. Addressing Parliament, outgoing NPA chief Shamila Batohi insisted that unhindered access to the files is critical.
Dlomo’s tax woes
In April 2026, Dlomo appeared in the Durban Magistrates’ Court on five counts of alleged tax evasion and five counts of fraud by omission. The SA Revenue Service claimed Dlomo owed R600,000 for failing to declare his income between 2018 and 2022.
Between March and September 2019, when Dlomo went missing from the SSA, the then state security minister, Dipuo Letsatsi-Duba – and later deputy minister Zizi Kodwa – were allegedly aware of his whereabouts, but the then acting director-general, Loyiso Jafta, was left out of the loop. Dlomo claimed he had provided seven sick notes to his superiors and had not absconded.
In 2020, Dlomo and his wife, Oarabile, filed for debt counselling and in October 2023 SARS obtained a default judgment for R1.4-million.
The deep state
The Zondo Commission concluded in its final report that Project Mayibuye was an umbrella for covert operations specifically engineered to shield Zuma from political fallout and to actively destabilise opposing political parties and individuals.
Through sub-operations like Operation Commitment, the agency bypassed all formal financial controls to withdraw massive amounts of cash, including alleged monthly payments of R2.5-million delivered directly to then minister of state security David Mahlobo’s office for onward delivery to Zuma.
In 2014, Kobus Meiring, head of legal services at the SSA, held a controversial meeting with the late Inspector-General of Intelligence, Faith Radebe – an encounter that later featured prominently in the SARS "rogue unit" saga.
At the time, Mahlobo had ordered an investigation after the Principal Agent Network was exposed as a covert, off-the-books operation siphoning off millions. The resulting Radebe report was later made public when EFF leader Julius Malema attached it to court documents during his legal battle targeting the late Pravin Gordhan.
Spies in the system
It was then that Dlomo’s involvement, alongside that of Mahlobo and the then SSA director-general, Arthur Fraser, was exposed alongside other “spies” including apartheid-era information peddler Riaan Stander, SARS’ spy Dr Mandisa Mokwena and tobacco-smuggling triple agent, Belinda Walter.
Stander issued a summons on 3 May 2013, naming Zuma and the minister of state security as defendants. Court papers became public and lifted the lid on how the SSA secret account siphoned off the cash. Stander was found to be a serial liar who had given Dlomo and the SSA the runaround.
During Mokwena’s 2017 prosecution for an illegal Unisa/SARS tender alongside 11 others, she used a “deep-cover” defence to shield herself from criminal accountability. Through her attorneys, Mokwena claimed to be an active “deep-cover agent” for the SSA and demanded that the agency provide her with personal witness protection.
She was employed in the Segmentation and Research division in SARS. Mokwena also claimed that Dlomo was her handler and that the suspicious deposits into her account had been cash payments for her undercover work for the SSA.
HR records confirmed that Mokwena had in fact been an overt contract worker from 13 August 2001 to 12 August 2004. Her salary had been processed by the SSA’s overt payroll system and her claim that the untraceable cash was for “secret work” was dismissed.
Mokwena’s legal representative, Johan Schaefer, claimed his client’s cover had been “sanctioned by an authority even higher than the minister”, specifically naming Zuma.
By alleging she was handled by Dlomo, Mokwena had attempted to justify fraud. And by deploying the defence, the SSA’s payment systems were made public. Mokwena was a former adviser to then SSA director-general Vusi Mavimbela, and later as manager of economic intelligence for the agency.
She was one of the first officials to advance, at the start of her trial, the narrative that a “rogue unit” existed in SARS and that she had been “set up” by former National Research Group investigator Johann van Loggerenberg who, Mokwena said, had been intent on destroying her career.
Mokwena was married to the controversial Barnard Mokwena, Lonmin’s human resources executive at the time of the Marikana massacre in August 2012. Mokwena joined Lonmin in 2005 and served as its executive president of human capital and external affairs and also as executive vice-president of strategic business transformation until December 2014.
High-risk litigation
Zuma parachuted Dlomo into the post of ambassador to Japan in August 2017, when his covert SSA dealings, including with Stander and Mokwena, began to threaten the agency itself.
The period between 2012 and 2014 in the SSA was one of mortal strategic failure, characterised by the collapse of internal controls and the erosion of covert operational security.
Under Dlomo’s watch, the SSA was taken to court by apartheid-era spy Riaan Stander, who issued a high court summons on 3 May 2013, naming Zuma and the minister of state security as defendants.
Stander had been recruited by Dlomo in November 2011 with a “verbal agreement” and was registered as a source in January 2012. His transition from a “handled to an extortion vector” culminated in an R11.9-million civil claim involving alleged unpaid services to the North West government, with Stander alleging non-payment by former North West premier Thandi Modise or her predecessor. This was found to be untrue.
He also falsely alleged he possessed information about a plot to assassinate Zuma and that he could obtain evidence that would exonerate the president during his Arms Deal corruption trial.
Stander’s litigation created a legal conduit for the public exposure of the agency’s most sensitive operations and was a serious breach of operational security.
**Systemic exposure **
The systemic exposure during Dlomo’s free rein at the SSA was, as illustrated in the court matters, a result of a lack of formalised source-handling procedures, which allowed unvetted “information peddlers” to weaponise the agency’s secrecy against itself.
The Mandlanga Commission has heard ample evidence of how much power and influence information peddlers appear to have when it comes to political and criminal manipulation.
Daily Maverick has requested from Idac an update on where the Thulani Dlomo matter now finds itself in the court system. We will update this report when we have received a reply. DM
