OnNet

Counter Cyber Operations, Incidence Response, Breach Readiness, Threat Intelligence, Adversary Pursuit, CNE/CNA/CND info (at)

[OnNet @OnNetServices]

Some of the trainings we have done, that showcase CNO operations in real world, are going to be on this book.

It’s fiction, but can also be used as a manual to develop teams and programs that can be used against adversaries.

Coming to you this ‘23, #C0nn3ctB4ck

Happy 2023.

[brokenpipe; @chuksjonia]

Kenyan Popular intelligence, is gone gone gone.

[brokenpipe; @chuksjonia]

Instead of snatch and grab op on a mere blogger, please use Cyberops.

Abducting and killing young kids will just bring more wrath against the government.

Rather code than coffins.

https://t.co/5RXgUCHmuN

[brokenpipe; @chuksjonia]

The funny thing is that some of these older ODM bloggers were serious orchestrators of Hacktivism by Anonymous groups in Kenya from 2013 to 2015.

All those Kenyan https://t.co/J01pzs1xoo sites that were being defaced, we ended up tracking most of the material support to some of these bloggers. They would approach young Pentesters and RedTeamers and since Kenyan government had cyber capabilities then, it was easier to run OCO and covertly get data/COMINT & SIGINT that showed the criminal activity that was supported by ODM party.

Now tables have turned and these criminals are in government. Isn’t it crazy that there is no background checks when most of the intelligence services in Kenya are aware that these people orchestrated and provided material support to damage Kenyan Government Infrastructure eight to eleven years ago?

[brokenpipe; @chuksjonia]

A lot of readers who have gone through these three books—especially after the @africahackon254 masterclasses—have mixed feelings about the twists. The espionage tactics deployed against Kenyan Military Intelligence felt real. Real-real, like for real.
So, let’s debunk the common ones, since most of them will make it to the TV show:

a) The ladies at the airport who wiped Brigadier Thuo’s HDD? Not Russian SVR. That was Mossad, masquerading as Russians to blind Kenyan leadership. The goal? Destroy that hard drive before Kenya could uncover what the Israelis were doing in East Africa—specifically their R&D operations in Addis Ababa. It was critical that this intel never reached Kenyan soil or triggered an investigation that might involve UKUSA, FVEY, or even NATO.
b) Taslim’s death? Not Mossad. She was actually their asset—working as a call girl. Priscilla recommended her, and Mossad recruited her in Ethiopia to spy on high-level politicians and targets. The ones who took her out? Yes, the IRGC. They needed to sabotage the Israelis and send Kenya on a wild goose chase, covering up their true objectives in the Horn of Africa.
c) Gebre was recruited by Brigadier Thuo and LT Nyalita after getting caught smuggling contraband at the Kenya-Ethiopia border—twice. In the show, it’ll look like LT Nyalita is recruiting him, but he’s backed by members of his group and the NIS. LT Nyalita personally trains him in weapons and streetcraft, but Gebre thinks he’s working for Ugandan External Intelligence (ESO). This misdirection is classic—hiding behind multiple walls to prevent leaks, especially now in the Information Era, where exposure can go south anytime.
d) The airport shootout? Not some rogue event. That was IRGC cutouts—former Ethiopian NISS officers working as mercenaries. They were deliberately sabotaging both the Israelis and Kenyans. Why? IRGC was after something bigger—and had to protect their deep-cover asset inside the Kenyan Embassy in Addis Ababa and their ongoing covert op.
e) Yes—Ambassador Priscilla is a double agent. She still works with Kenyan NIS but spies for Mossad, using a cipher system for online dead drops. In Operation Frozen Trees, we see how Mossad first recruited her when she was Chief of South African Operations—and why she turned, despite her uncle being a powerful man at the time.
f) The Israelis had to cover their tracks. To protect Priscilla, they deployed a destructive implant inside the Kenyan Embassy, making sure any video footage of Bole Airport never leaked. Why? Because both NIS and Mossad were at Bole during the chaos—shadowing Gebre and hunting the HDD.
The twist? NIS didn’t know Mossad was there. But Mossad knew because they had an asset inside the Kenyan Embassy. And IRGC? They had penetrated deep enough to know both agencies were in play. When Mossad realized they were up against a bigger adversary, they launched a quick CNA (Cyber Network Attack) at the airport—wiping CCTV footage clean.
But they forgot to hit DR. The backup footage was still coming through.
IRGC capitalized on the chaos, pulling a classic Mis-Direction 101—sending both Israelis and Kenyans chasing their tails all over Addis.
g) The Islamist who stole the cargo at Bole’s secure Israeli armory depot? Not Al-Qaeda. He was IRGC. They knew exactly what Mossad was building and testing in Ethiopia. And in Operation Frozen Trees, you’ll finally learn what that was. And yeah—it was bad-bad. (Yes, the book is still on Kindle. Paperbacks dropping soon.)
h) The gunfight at the safehouse in Addis Ababa—where we meet Eunice Langat? Not the Israelis. That was IRGC.
In the real world, the Mossad-IRGC conflict in the Middle East and Horn of Africa is absolute chaos. If you’ve ever worked in intelligence, you’d know—Iranian MILINT is no joke. They’re bad-shit killers.
i)

[brokenpipe; @chuksjonia]

Meet at @BSidesNairobi and we’ll talk Cyberwarfare, CyberDefense, CyberOperations and everything Information Operations. 🙌🏿🙌🏿🙌🏿🙌🏿

[brokenpipe; @chuksjonia]

More copies have arrived in Nairobi. Sending them to @NuriaStore

[brokenpipe; @chuksjonia]

God forgive me, for what you are going to see in this sequel 🫣😳😳😳

#C0nn3ctB4ck : Operation Frozen Trees (OFT)

[brokenpipe; @chuksjonia]

I am from the green part of the continent and I am the first author in the whole wide world, to write authentic cyber ops novels that showcase SIGINT collection, cyber attacks, CNO Planning and others, plus how that interacts/blends with special warfare units, to reach a commander’s objective in Peacetime and in Wartime.

There are people who have come up with other products too, e.g Mpesa.

Don’t be a racist!

[brokenpipe; @chuksjonia]

If you loved Part one and The OJT, part two is gonna be crazy with gunfights inside Tigray. Experience how cyber and other techs are using during Special warfare.

Part Two #OperationFrozenTrees is still going through rounds of Developmental editing. Coming soon:

[brokenpipe; @chuksjonia]

This totally reminds me of a Colonel who schemed from software budgets, especially the ones required for OCO.

I have brought up a scene about him on my latest book #C0nn3ctB4ck :The OJT

In all seriousness guys, it happens more than you think, especially for most of the developing Nations where the Presidency or a General doesn’t understand cyber and they are easily duped in those mahogany budgets.

[brokenpipe; @chuksjonia]

Love this review:

https://t.co/Cc2tcxYpn7 #C0nn3ctB4ck :The OJT

[brokenpipe; @chuksjonia]

Many people have long believed that Africa doesn't have serial rapists or killers. However, these predators do exist. This reality was underscored by a case earlier this year when a well-connected girl was brutally murdered. Most of these assaults are planned, with victims targeted first via the internet before the crimes transition to the meatspace/physical realm. Many of these assaults often go unreported, especially when the target is a low profile victim (LPV).

The short story, which has evolved into a novelette, is inspired by these incidents, with the hope that it will impart lessons to young women about the importance of both cyber and physical security.

𝐃𝐨𝐧’𝐭 𝐘𝐨𝐮 𝐑𝐮𝐧 — 𝐂𝐡𝐫𝐢𝐬𝐭𝐦𝐚𝐬 𝐂𝐲𝐛𝐞𝐫 𝐌𝐢𝐫𝐚𝐜𝐥𝐞, 𝐚 𝐬𝐡𝐨𝐫𝐭 𝐬𝐭𝐨𝐫𝐲: Paige was a heartbreaker at JKUAT. A year ago, she was raped by several boys from college, including Gideon, her boyfriend at the time. The traumatic experience led to a pregnancy and, ultimately, a miscarriage. Despite the ordeal, she returned to school, but her father transferred her to a new university, USIU-Africa. Her sudden departure left her friends curious, but she tried to distance herself from them because they had turned their backs on her, especially after the assault. However, her past came back to haunt her when she started receiving frightening messages from a creeper, likely someone from her time at JKUAT. She had avoided everyone from her past life, including her old circles, as if it were a former existence. Then, everything changed on that Saturday night when she attended the end-of-year party.

[brokenpipe; @chuksjonia]

Yes, my editor’s copy just arrived. #C0nn3ctB4ck : TheOJT

[brokenpipe; @chuksjonia]

Still can’t believe #APT41 literally called themselves an APT that offers an APT Service system. 🤦🏿

[brokenpipe; @chuksjonia]

From studying iSOON, one thing I always knew is that Chinese cyber operations contractors share CONOPs, capabilities, and TTPs. Apart from ChengDu 404's fights with iSOON, these groups shared a lot more than what we see from other APTs around the world.

Yes, the US does stockpile and share capabilities through clearance to different units. Maybe that’s where they learnt that from.

When I saw Blackwood & PlugX being used by different groups with just minor changes, and then the use of BPFDoor emerging from different Chinese APTs in China against African Telkoms, I knew things were not the same. Anyway, the iSOON leak clears up most of these questions for me, and I hope someone drops some intel from Chengdu404, soon.

[brokenpipe; @chuksjonia]

In certain instances, highly capable nations conduct Foreign Internal Defense Training (FIDT) for both Meatspace and Cyberspace. However, these training sessions are typically shrouded in secrecy due to concerns about the potential leakage of Tactics, Techniques, and Procedures (TTPs). Trainers are often instructed to limit the dissemination of knowledge that could significantly advance the capabilities of the host country. Specifically in Information Operations, cyber ops, and cybersecurity, the offensive tactics commonly taught involve tools such as Kali, Metasploit, nmap, etc., placing an upcoming operator on the level of a beginner or Pentester. As a commander or team leader, what strategic advice would you propose to upper leadership to ensure the success of these training programs? Do you believe that real-world training, particularly for CNO Operators, plays a crucial role in advancing the capabilities of your team?

[brokenpipe; @chuksjonia]

Apart from several confidential documents, there are some funny investigations.

Employees drinking like fish.
Dirty spoons.
Ghost employees etc etc.

[brokenpipe; @chuksjonia]

Defray777, also known as RansomExx2 and formerly known as RansomExx, compromised Kenya Airways a while ago. Since KQ didn't pay, the group leaked close to 3GB of their data online. Some of the leaked data was sensitive, particularly containing damaging information on several incidents/investigations involving KQ flights, airports, and shipping.

RansomExx is part of the FIN Groups that transitioned their main payload from C/C++ to Rust for deploying Ransomware. The change from RansomExx to RansomExx2 is a counterintelligence maneuver used by Russian FIN groups to evade tracking by CTI and counter-cyber organizations.

The group utilizes IcedID ISOs for Initial Access Operations (IAO) and Cobalt Strike for lateral operations and data collection. #KQHack #cyberattacks

[brokenpipe; @chuksjonia]

In class we usually tell Military and Intelligence services’ students, that stealth during CNE is crucial. And one statement is that none of them should wish for a @Mandiant APT/ UNC number.

@780thC @JohnHultquist @cyb3rops
@ImposeCost @HostileSpectrum @cglyer @ItsReallyNick @KimZetter @IWCsync @MrDanPerez @secman_pl @MalwareJake @JasonAtwell14 happy holidays and a successful new year countering cyber ops 2024 🫡 .

[brokenpipe; @chuksjonia]

I think @esmailcorp writes amazing cyber thrillers. Guys check out #LeaveTheWorldBehind on @Netflix

@samesmail please check out my new Cyberwarfare and Cyber operations thriller, #C0nn3ctB4ck : The OJT

https://t.co/VfslweLN90