IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Fake Update, Real Trap: The Android Banking Malware That Turns Trust Into a Weapon
Hirudo is reported to combine a lure app, a second-stage payload, and a banking-app replacement flow that targets the way Android users trust updates and identity.
Fake Android Updates Are Turning Banking Phones Into Remote-Controlled Targets
A reported Android malware campaign blurs the line between app updates and cyber intrusion, exposing users to credential theft and app-manipulation claims.
Artifact Trapdoor: How the LiteLLM Supply-Chain Attack Put AI Secrets at Risk
A compromised release pipeline reportedly shipped malicious wheels and container images, but public evidence does not establish successful theft of credentials or secrets.
When a CAPTCHA Becomes the Payload: The Windows Tool Hidden Inside a Search Trap
A lure built around Amazon-themed search results and a fake verification page reportedly pushed users toward a command-chain that used Windows' finger utility and was associated with Lumma Stealer.
When a Tor Exit Turns Hostile: The SSH Trap Behind a Reported Relay Takeover
A claimed campaign against hundreds of Tor exit relays shows how anonymity infrastructure can become a pressure point without breaking SSH cryptography itself.
Release Trust Snapped: A Hijacked Developer Account and the OVHcloud CLI
A short-lived swap of release binaries in the OVHcloud CLI shows how one compromised publisher identity can turn a routine download path into a supply-chain hazard.
How Old Malware Still Shapes the Fight Against Ransomware and AI
A historical look at Creeper, Reaper, and modern ransomware shows how attackers and defenders keep forcing each other to adapt.
Backdoor Allegation Turns a WordPress SEO Plugin Into a Supply-Chain Warning
Rank Math PRO was reportedly distributed with malicious code through its normal delivery path, a reminder that trusted software channels can carry risk when package integrity is broken.
Trusted Plugin, Untrusted Payload: The Rank Math PRO Malware Incident Raises the Stakes for WordPress Owners
A premium WordPress plugin was reportedly used to distribute malware in a limited release window, putting site operators back on alert for supply-chain risk and post-install compromise.
Trusted WordPress Code, Untrusted Payload: The Rank Math PRO Incident
A reported malware event tied to Rank Math PRO 3.0.123 shows how a plugin update can become a distribution risk long before defenders know whether anything else on the site was touched.
When a Trusted CLI Release Becomes the Attack Surface
A compromised GitHub repository and a developer account turned a software distribution channel into the threat vector, but the available evidence does not confirm execution, theft, or the full blast radius.
A Trusted Backup Tool, a Fleeting Tamper Window, and the Malware Question No One Can Answer Yet
A brief supply-chain disturbance around AOMEI Backupper reportedly pushed a downloader linked to ShinyRoad, but delivery alone does not prove execution, infection, or impact.
Malware in the Update Pipe: The Rank Math PRO Package That Broke the Trust Model
Rank Math PRO version 3.0.123 was reported to have been shipped in compromised packages, but the known facts stop at distribution - not installation, execution, or downstream harm.
A Font File, a Workspace Trap, and a 94-Repo Shadow Trail
Researchers say a GhostAction-linked cluster widened from malicious workflow abuse to a more local trick: luring developers into a project that could launch a credential stealer through VS Code if the task was triggered.
When a Developer Shortcut Becomes the Trapdoor
A fake Web3 accelerator reportedly used malicious npm packages to push malware, while a repackaged AI tool may have rerouted model traffic through attacker-controlled infrastructure.
Hidden Native Code in npm Package Raises a Supply-Chain Alarm
Researchers reportedly tied the package "imgdecode" to MALFEX after finding a Windows native addon that contained a shellcode loader, a pattern that demands careful review but does not itself prove any victim compromise.
When a Font File Becomes a Delivery System, Developer Trust Becomes the Target
A GitHub campaign tied to GhostAction shows how repository config, disguised assets, and VS Code automation can turn an ordinary project clone into a risk decision.
When a Repository Becomes a Run Command: The Hidden Risk Behind Developer Trust
A reported GhostAction campaign points to a sharper edge of software supply-chain abuse: repository content that may be used to trigger code on a developer’s own machine.
Six Servers, Two Payloads, One Delivery Trick: The ROMULUS Trail Raises the Stakes
A reported ClickFix infrastructure cluster tied to multiple payload routes shows how malware operators can separate delivery from payload, complicating attribution and detection.
GhostBat’s Quiet Play: Android’s Permission Layer Becomes the New Payment Battleground
A reported GhostBat variant points to a familiar but dangerous pattern on Android: if an app can abuse accessibility access and overlays, the fight shifts from the bank’s backend to the screen in your hand.