IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
A Package That Looked Clean Until It Ran
A malicious npm package called indexed-btree illustrates a sharper supply-chain trick: hiding bad behavior in normal runtime code, beyond the reach of install-script checks.
PowerShell’s Quiet Heist: What TASK#STOMP Reveals About Data Theft on Windows
A reported PowerShell backdoor campaign shows how attackers can turn ordinary Windows features into a low-noise collector for documents, credentials, and screenshots.
Profile Data as a Hidden Mailbox: ROOFDECK Turns a Public Protocol into Malware Rendevous
A macOS backdoor tied to a GitHub job-lure chain shows how attackers can use ordinary-looking profile metadata to mask command-and-control infrastructure.
When the Blockchain Becomes the Backdoor
A malware campaign is using Polygon as a mutable control layer, showing how public blockchain infrastructure can be repurposed to steer theft without constantly rewriting the victim-side payload.
RatHat Turns Android’s Trust Features Into a Banking Trap
A newly described Android banking Trojan is built around permission abuse, overlay tricks, and wireless debugging, showing how everyday phone features can be chained into credential theft.
Windows, Hiding Places, and a Miner: The Malware Chain Built to Evade Easy Detection
A cryptomining operation reportedly stitched together PowerShell, the Registry, DNS TXT records, and disguised media files to deliver XMRig on Windows systems.
Hidden in Plain Windows: The PowerShell Loader Chain Feeding XMRig
A cryptomining operation is using PowerShell, registry data, DNS TXT records, and media files to mask the path to an XMRig miner.
The Hidden Trap in Trusted Widgets: How One Embed Can Become a Malware Pipeline
A suspected Brevo-related supply-chain abuse case shows how one upstream web dependency can turn ordinary forms and chat boxes into a broad malware delivery path, especially when social engineering is added to the mix.
When a Chat App Becomes a Spy Rig: Telegram’s Role in the Chosen Brick Case
US, UK, and Dutch agencies published a joint look at Chosen Brick, a surveillance malware case that underscores how ordinary messaging services can be bent into command channels.
Noodle RAT Turns the Windows-Linux Divide Into a Blind Spot
A cross-platform backdoor family with long-running aliases shows how one implant can blur attribution, persistence, and detection across mixed estates.
Rental Malware Is Getting a Better Sales Pitch: VectraRAT and the Windows Trust Gap
A newly documented Windows malware service is being framed as a low-cost package for privilege bypass and credential theft, a reminder that cybercrime now sells convenience as much as capability.
Noodle RAT’s Real Trick Is Not Speed - It Is Looking Routine
This cross-platform backdoor leans on built-in Windows and Linux scheduling features, then uses process camouflage to make long-term access harder to spot.
RubyGems at the Edge of Automation: Why a Package Flood Became a Trust Problem
A reported wave of 3,022 malicious RubyGems packages shows how registry metadata, docs processing, and publish APIs can become a high-volume abuse path, while AI attribution remains unproven.
Casbaneiro’s Hidden Gate: Why a Banking Trojan with Split-Path C2 Matters
A Latin America-focused malware run shows how geography checks, phishing lures, and dispersed command-and-control can turn a familiar banking trojan into a harder target for defenders.
Trusted Windows Tools, Untrusted Emails: The mshta.exe Trap Hiding in Plain Sight
A phishing chain built around a legitimate Windows binary shows how legacy script runners can become a quiet entry point for reconnaissance and credential-focused malware.
KATARU Shows How Old IoT Weaknesses Still Power New Botnets
A newly observed malware family chains Telnet password guessing, Linux privilege escalation attempts, and DDoS enrollment into one automated workflow.
MacSync Turns Mac Trust Into a Trap, Using Fake Fixes to Chase Passwords and Wallets
A macOS stealer campaign built around social engineering shows how copy-paste deception can matter more than a software bug.
When the Web Shell Lives in Memory, the Disk Tells a Lie
A malicious PHP implant tied to F5 BIG-IP APM tampering shows why defenders must check what an appliance serves at runtime, not just what its files look like on disk.
Infostealers Turn AI Coding Assistants Into a Fresh Credential Cache
A familiar malware class is widening its net from browser secrets to local data left behind by AI developer tools, raising the stakes for workstation security.
AI Tools Meet Zero-Click Messaging Risk in a WeChat Worm Demo
A Palo Alto-based security team has put a fast-moving question on the table: when AI helps build exploit code in days, how much warning time do defenders really get?