I looks to me as if the call can in in Trunks 7 and rang to an ACD path. from there it went to 4400 and was transferred out to 00251917102052.
I'm not sure what 2300 is.
Are you sure your VM ports are locked down and not able to xfer out?
COR, COS and perhaps Interconnect Restriction?
My instincts tell me that a VM box was hacked and an external cell phone was put in that points to the Ethiopia number.
You may also want to block the country code for Ethiopia.
Ralph