Monday 30th, August 2021. Two weeks earlier:

Somalia, brazen desert on most parts of the Eastern side of Indian ocean, the sun continues to slide low on the far end of the dark waters, from the Mareeg district.
Hot and dusty, always has been a war zone for the better half of the last century and this decade too.
The country had witnessed several civil wars. Eventually, with uprising of the Al Shabab terrorist group and Indian Ocean Somali Pirates. Kenyan Defense Forces had to intervene into a long war, which was, allied with local militia like the Raskamboni Movement especially on the take-over of Kismayo. The movement leaders lived in Eastleigh Nairobi and remotely coordinated the push against the Al Qaeda associated terror group, which proved a success during the initial offensive.

Eastleigh has always been the 'Little Mogadishu' inside Nairobi. Growing into a huge suburb with Billions of shillings in wealth and assets rotating each day. Further, south, Down-south of Puntland, Mareeg, on the East South coast of Somalia. A town grew with hidden spots and caves for the Al Qaeda covert meetings and exchange of weapons/tactics and Prisoners of War. Particularly with Al Qaeda Arabian Peninsula members sailing in from Yemen and covertly sneaking through Puntland or around its border. 

It became an advantageous ground, to coordinate plans and deliver messages back and forth between the affiliated intel groups. Their intelligence officials were selected and are, by the leadership, then they are known as the Amniyat. This was after the fall of Kismayo, since most of the terror group fighters abandoned the city and fled to several locations inside Gulf of Eden and the others disappearing into impenetrable, tribal mountains of Galgala, north coast, the Horn of Africa thus becoming ideal for surreptitious Al Qaeda Summits.

A few miles off the Mareeg coast, a young boy sits up on a hut with American army combat binoculars. Probably stolen from Kenyan military bases that had been overrun before, like the El Adde base, January 2016. The boy looks over the small town toward the seaside expecting a change, waiting for the sun to set and then spits out a large snort encapsulated from the heavy dust surfing through the coastal winds and takes back the gaze ready to report to some commander down at the torn-off town who had sent him there, earlier.

It is his job. He is a watcher. His boss pays him daily and he gets to feed his younger brother back in the village after their parents were killed, by a US drone strike two years ago. He is the caretaker, the big brother. The mother. The father. Several families outside Mogadishu have suffered such losses from the hellfire strikes. Making it worse, Turkey took the mantle on this war. They are even exporting drones technology to Somalia.

The boy does his assignments well. He reports on a big torn-up radio. He is told to wait until dusk.
The rocks on the desert around him shoot like dotted up small golf balls in the dusty neighborhood, with a clear engulfing blue sky also well-known as the Arabian-Blue-Skies. The skies, gradually melts behind the falling sunset, which was now sliding down with a heavy humid breeze approaching seaside into the village. Slowly twilight descends with prelude to darkness, the intensive desert night of Eastern Somalia.

The young boy picks a small matchbox and sets on a lamp then puts it off, a signal to a small stagnant boat - a skiff, miles away in the ocean. Two men laying low on the boat’s belly start the engines and set off toward the village.

The two men alight after a few minutes ride to the ocean-wet-sands and the boy has the lamp on again and counts to twenty as always instructed and trained. He then blows it off as two men approach the dusty rough road from the beach. They pass a carcass of destroyed vehicles covered with sand-dust and afterwards, a long dirty-bearded, tall skinny man emerges from a cave-like rock down below the rough road. He had dirty old scarf around his neck, weaving through with the winds, covering most of his beard.

He hugs and kisses the two men. “Asalam aleikum.”
And in unison, they reply “Waleikum salaam warahmatullahi wabarakatu.”

One of the men continues with another reply, after a longer hug. A long hearty embrace that looked like forever.

They follow the older man into the cave where a Sony camcorder was mounted next to three kneeling, tied up and mouth-gagged-muzzled trembling men. One of the men who seemed like the leader because of the way the other men fell behind him, walks toward the three prisoners and with a sign of relief murmurs, “Allahu Akbar!”
He stretches his arms up as if to pray and repeats the same phrase again. He then signals to the older man to have the camcorder powered on.

“By the grace of Allah the merciful, we have captured one Americani infidel, two Kenyans intelligence officers, Jasusin khainun, and killed the local Jasusin. Kafir! ”

He pauses and continues, well-paced with his words. “With the path of Jihad, the path of the prophet —” He pauses again this time smiling.
“Mohammad Dardir, Hamza Al-Ali, Rashid Al Qasabi na Faisal Khader!” He pauses again, collectively taking a deep inbreathe and then turns at the prisoners with red steering eyes, “Allahu Akbar!”

The other men recite the phrase appropriately, in concert after him and the older man walks over, switches off the camcorder and whispers inwardly, “Masha Allah…”
It was go time for the next phase of their campaign.

The older man pinches out a small memstick off the camera storage bucket, turns to a table full of weapons, mostly old Kalashnikov rifles and gets the stick wrapped up in a paper. He then sticks it tightly into a camo-jacket nearby and into its inner pocket. He sighs, ready for travel. First stop, Al Jazeera, Nairobi office via a trusted courier.

The leading man pauses and glances at his men, walks backwards to the prisoners, who were now sweating profusely. “We will send this! Both to Washington DC - and Nairobi, pray to your god, they listen! Your two brothers from Mogadishu, have already been hanged.”

“Eebaha muuse iyo haaruun —” The older man replies in his dialect, then thanks God again, “Allahu Akbar.”

They praise, they plan and thinking how lucky they are to capture an American Central Intelligence Agency Case officer within the borders of Somalia. Even Al Qaeda chiefs at Yemeni wanted a piece of the action, though they were the ones who provided the intelligence and identification of the targets. Now their prisoners. The Abdullah Azzam Brigades had a source and mountains of data, that could exploit the Covert Intelligence Network at a large scale, operating in the horn of Africa to Middle East.



Chapter 0.9
UID = 0

Friday 17th, September a week later:

Vanessa registers she had blacked out early after a long day running the field operation. She still hadn’t realized it was after midnight when she pulls out of the bed. Things went wild after the yesterdays field op, reason James.

She was lucky the contact was still live on the command and control. Vanessa had to remove the loader and initiate YaToosh implant like yesterday. The box was calling home every sixty minutes on the loader panel. The sessions on the terminal were several by now. All seven sessions had gone stale except the last. Four of the last sessions had a different public IP that started with a “197.” too. YaToosh implant was already implemented persistently with a session intact. So she melts the loader off the target wishing she actually did so earlier . She hadn’t done a proper melt and if Kharim did a simple threat hunt, he would have found the Portable Executable on the persisting folder. Reason for the miserable misstep was James, again. It was an opsec failure especially with the loader persistence gone rookie, at a startup folder.

With the change of IP, several reasons came to mind. Kharim Saadiq moved his laptop to another location or they had two internet connections at the embassy. She didn’t have a chance during the initial deployment to check where the laptop was especially after that webcam shot in the evening. The YaToosh implant usually has the camera light on during the shots. Vanessa had to do two shots. The first warms the web camera and the second gets a clearer image.
But those webcam shots had a view of what looked like an operations room.
The Somalian shooter with his coffee mug.
Two men behind him covered in dirt.
All well armed, with vests on and dirty boots.
They all seemed like they just came from a camp.
Then, the screenshots of Kharim Saadiq desktop, bruteforcing the darkweb server, on his Windows laptop.

If the server was dead, why hadn’t he noticed the broken pipes? Why was Kharim on Windows during his field operation? Who goes with a Windows machine to run a field op?

Vanessa flutters out some air between her lips.
She knew at some point only rookies go with Windows machines on a remote ground operation. Besides, the network he was in, showed he had Linux machines tied into the subnet.

Vanessa acknowledges its dark already and camera shots would get her caught. She suddenly feels herself being slipped into that geek in-between space. Her fingers momentarily return to the keyboard. She checks the Download folder and scans through to confirm if all files were securely transferred.

Her windows PC had all RIST and Associates repos downloaded too. She figures she is going to use some of those repos for a toolkit that can handle the cam modules without an LED light coming on. They hadn’t made one, but prep-work and research was documented on the directories she had just pulled down. The web camera shots used in the Somalia Palace hack were for Apple computer targets. Alex had done them in Objective-C. A language Alex had grown intimately familiar with, for the most of year 2020. The toolkit she was keying for, had to be on C/C++ language because of the Windows API.

Vanessa is struck by a small chill remembering the web camera shots they had ran for everyone working at the Villa. They had insidiously observed all employees like clockwork. And now she was about to do the same thing. But this time, to the killers who were after her. Not some revenge hacktivism like before. The toolset she was getting into required COM, which was Component Object Model introduced by Microsoft through its Office Suite of applications. She had witnessed Alex call video input device category with COM. She saw him use the initialization of CoCreateInstance function and deliver it successfully.

But working with COM was a total headache. Vanessa taps her finger on the mouse-pad, thinking she should have taken Alex classes on COM, much more seriously. She presses together her lips with hesitance as she reads through MSDN’s BITMAPINFOHEADER structure.

By now Vanessa was getting more worried over COM than the gunmen after her.
Vanessa had questions for Alex, but all she could do was read more code from Github.
Only a few had done something with C.
A few crazy ones did it with Assembly.
None of the users had showcased handling of a webcam using bitmapinfoheader.
If she would get round to it, the only issue left would be to save data on disk and socket it out of the target box.

In a few minutes she understood she was going to use dshow.h header and had to pragma comment the strmiids library with an addition of strmbase library.
Vanessa at this point was dreading the reason she started the project.
To stream out the target without them noticing was an objective she had to meet.
YaToosh was already key-logging the laptop.
She had done a stealth scan of the internal network by now.
There was no residue of the loader on disk.
Kharim-Desktop’s microphone was hot.
Last screenshot showed the laptop was locked.

Vanessa runs her hand up and down her face, prepping a coders playlist. Lonely by Cut Off rang out first, followed by Pete and Tommy with Treat me right. Deep House music always bought in fresh innovation and a relaxed mindset, for Red Team coders.

Vanessa had to constantly double back to MSDN for more details. She got WinMain set for the entry and CoInitialize on zero. She clicks on the RIST And Associates repo folder, for Research and Development and goes to Webcam folder. She then clicks the directory open. She scans through to Device Fetch-Analysis in COM folder. The dates showcase the same because they were collected via sftp. She scrolls down to the notes on CreateDev file. She opens them up and Alex had noted ‘it was important to have CoInitialize on zero so that the play on CoCreateInstance would be smooth when having CreateDev as the variable with the address that receives the interface requested upon successful return, as a Local Pointer Void.’

Just like any other coder, Alex had not explained well. It was one week since she lost him and this almost made her lose her shit. A muffling grunt goes off as she gulps a sob. She remembers the jokes Alex made up about combase and COM objects, and the hatred he had for GCC on windows. When COM discussions came up, he always said a COM object will always call ETW. ETW being Event Tracing for Windows, could be bypassed at some point with DllGetClassObject or patching with a syscall entry. She had to capture this on her code rather than remove logs with YaToosh’s Events-wipe module on the target box. In fact she decides to switch to the laptop with YaToosh terminal active. There was a notification the keyboard is active on the running implant. She runs ‘keys dump’ command and several logs spit out.

[YO-TOOSH#] keys dump
[++LANDEDONLZ++] dropping all logs to keystrokes/keys_DEADBEAT17_2021-09-17-02-44-02.log
2021-09-17 01:38:39.511000: LockApp.exe Windows Default Lock Screen
2021-09-17 01:39:43.481000: TrGUI.exe TrGUI
2021-09-17 01:39:54.813000: Explorer.EXE NISA-FGINBFILES
Embassy Staff
2021-09-17 01:39:59.656000: Explorer.EXE Delete File
2021-09-17 01:42:19.285000: Telegram.exe Telegram
Caisho Ali, ID Number 30543818
She is a Spy
Yes she needs to be stopped!!!
Sonko\u2019s gorgeous aide wants to be Msambweni MP

Vanessa’s hands were surprising steady as she continued scrolling through the log file. The messages from the recipient weren’t coming through because the keyboard was from a non implanted device.
So she had to run screenshots on the session.
She pushes the command ‘screens’ to get the images.
The messages had a detailed dossier on Aisha Ali.
A Somalian working as spy for Kenyan authorities.
Several CCTV images showed what she had done.
She had walked to Assistant-Ambassador’s, Mohammed Abdullahi’s office. Just on the upper floors and attached a malwared flash disk. She had tried to execute the Auto-run manually.

Her photos were attached on the chat conversations.
She had a dark lingerie.
She was seated next to a laptop.
She had walked over to the next computer.
She had sprinted under a table when a guard walked in.
She managed to get out when the guard left.

Vanessa finds herself staring at the mention of capturing and killing a spy. The disinformation campaign that Friday had said Alex works for the National Intelligence Service. The word kill held the capitals. Vanessa was still staring at the word ‘kill’ until the image started to blur. She had someone she could call. Or actually she did not. Maybe the same cop who called her when she was in Sarit. Vanessa had to use WhatsApp because by now all cops had it installed. She couldn’t use a direct line because they would track where she was. Besides her SIM card was still somewhere on the tables and she had forgotten which drawer that was. She had saved Inspector Letui’s number as ‘The Fucking Popo.’ when he called again on Monday, or maybe it was on a Tuesday.

Vanessa gets off the chair. Gets to her iPhone. Unlocks it. Scrolls to The Fucking Popo phone number. Goes to the WhatsApp icon. She presses the key to connect the call. The lines pings thrice.

“Hello, Inspector Letui.”
“Yes Karam?” Letui asks. “At last you called. As i said—”
“Listen.” Vanessa interjects. “The assholes who want me dead, want another girl dead.”
“Where are you Miss Karam?”
“Fuck! Listen, a young girl. A call-girl. Aisha Ali. Another name Caisho. It’s also Somalian for Aisha.” Vanessa explains.

Letui asks, “What?”
He sounded sleepy. Drowned and calm, almost the same way he had on Friday night when Vanessa was running near the gym walls at Sarit Center.

“Like i said, Caisho, another name Aisha. Surname Ali. She is marked as the next target.”
“They are a section, of an Interagency. East African Intelligence operators, Called ETAG.” She continues trying to explain, though Inspector Letui felt lost in the conversation.”East. Africa. Threat. Analysis. Group.”
“KARAM—” He repeats her name, this time yelling.
“I will send you some screenshots.” She says and hangs up the call.


What We Can Offer

Glossary for Prologue and Introduction Chapters:
The book has a lot of cyber and intelligence terms and so each chapter will have its glossary as shown here. 
More Glossary


This is the intelligence branch of Al Shabab. You can tell they are running operations in the desert with some Al-Qaida individuals on the Books Prologue.


YaToosh is the implant Vanessa is using to spy on an individual in a Safehouse. It is modular but lacks the secure webcam delivery. When targeting bad guys, we usually have to run operations in a secure way for covert collection of Intelligence. However, in some operations, a target does not know if he is being observed. YaToosh is Hebrew for Mosquito. Its explained well in the other chapters.


This is a fully fledged backdoor with extended modularity that is used on clandestine collection for Signals Intelligence on an endpoint. It’s explained further on the coming chapters.


This is operational security. It is part of a study known as Information Operations, which is like an upgrade of Information Security to cyber.

© Copyright 2022 Chuksjonia Books LLC - All Rights Reserved