IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
When Malware Starts Renting Space on a Blockchain
ClearFake’s use of EtherHiding on BNB Smart Chain testnet smart contracts shows how on-chain storage can complicate the hunt for command-and-control infrastructure.
Fake Interviews, Real Theft: How InvisibleFerret Turns Developer Trust Into an Entry Point
Developer job lures are being used to deliver InvisibleFerret, a malware family tied to browser credential theft, crypto wallet targeting, and risky access to CI/CD environments.
When a Build Tool Becomes Cover: The PureLogs Campaign Hiding Behind MSBuild
A phishing lure dressed as a purchase order is being paired with MSBuild abuse and process hollowing, a combination that turns ordinary Windows trust into a stealth path for infostealer activity.
BTMOB Pushes Android Malware Beyond Theft and Into Remote Control
A newly observed Android RAT is drawing attention because its value is not just in stealing data, but in giving an operator practical control over a victim’s phone once it is installed.
When a Single Image Can Become a Payment Scam on Older iPhones
A reported zero-click chain linking WhatsApp for iOS and Apple’s ImageIO framework highlights how legacy iPhones can turn a chat app into a stealthy fraud surface.
Ghost CMS Poisoned Pages Turn Trusted Sites Into ClickFix Traps
A reported Ghost CMS exploitation chain shows how one web publishing flaw can be turned into a browser-based lure that blends legitimate pages with malicious JavaScript.
When Tags Turn Toxic: The Laravel-Lang Poisoning Case and the Hidden Risk in CI
Malicious package tags published in a short window turned a routine dependency path into a potential route for stealing build-time secrets.
Search Results Became the Bait in a New Software-Download Ambush
A lure built around SQL Developer shows how a threat cluster can turn user search intent into a delivery channel for malware, without relying on email at all.
Compiled Python, Fake Interviews, and the New Shape of Developer Bait
A malware campaign described through InvisibleFerret shows how recruiting lures and native-looking Python artifacts can collide inside a developer workflow.
Fake AI Tool Downloads Turn Search Results Into a Developer Trap
A lure built around Gemini CLI and Claude Code shows how SEO poisoning can funnel developers toward a fileless PowerShell infostealer.
A Quiet Dependency Turned Into a Credential Trap
A compromise in several Laravel-Lang PHP packages shows how a low-profile update path can become a high-trust delivery channel for credential theft.
Old Router Flaws, Fresh Botnet Power: Why a 2018 ASUS Bug Still Matters
A long-known authentication flaw in ASUS routers has reappeared as a useful tool for RondoDox, showing how stale edge-device bugs can still fuel modern botnet campaigns.
When a Windows Shortcut Becomes a Scanner Trap
A junction-based traversal trick shows how ordinary NTFS features can turn recursive endpoint inspection into a reliability problem.
Arrest in a Botnet Case Exposes the Business Logic Behind DDoS Crime
A Canadian arrest tied to the Kimwolf matter highlights how botnets turn weakly protected devices into rented traffic weapons, and why the legal fight is now as important as the malware itself.
Botnet for Sale, Suspect in Custody: The KimWolf Case Exposes the Machinery Behind DDoS Abuse
Authorities’ arrest in connection with KimWolf puts the spotlight on the control layer, not just the malware: how compromised devices are organized, rented, and used to flood targets at scale.
Shortcut Lures, Trusted Tools: Inside a Campaign Built to Blend In
A phishing operation tied to malicious Windows shortcuts shows how attackers can hide in plain sight by abusing familiar file types and legitimate software ecosystems.
MSHTA Still Opens a Quiet Door for Windows Intruders
A legacy Microsoft utility can still be turned into a stealthy execution path, showing that retiring Internet Explorer does not retire every browser-era risk.
Trapdoor’s Mobile Fraud Machine: When Android Apps Become Ad-Tech Weapons
A large Android campaign appears to have turned app installs, hidden web content, and remote commands into a scalable fraud pipeline that strained the line between mobile software and criminal infrastructure.
Hidden in Plain Sight: How BadIIS Turns IIS Servers Into Traffic-Control Nodes
A malicious IIS component can sit inside a web server’s request path, redirecting selected traffic while leaving the site looking normal to most visitors.
Gremlin Stealer Hides Its Tracks in Encrypted .NET Resources and Runtime Bytecode
The latest Gremlin Stealer variant appears built for delay and concealment, combining encrypted resource storage with a commercial packer that turns ordinary code into custom bytecode.