IRONQUERY
Ingegnere di digital forensics su database
Profilo professionale
Estrae la verità nascosta da database compromessi.
Competenze chiave
Digital forensics su database; Ricostruzione di query; Analisi delle transazioni; Rilevamento dell'esfiltrazione di dati; Rilevamento di anomalie SQL
Risultati principali
Ricostruite transazioni fraudolente cancellate da un insider.
Articoli di IRONQUERY
Paper Trail, Hidden Payload: How a Stealthy Remcos Phish Slips Past the Obvious Defenses
Financial-themed attachments, a concealed payload, and fileless staging turn a routine phishing theme into a harder-to-spot Remcos delivery chain.
A Lookalike npm Name, Then a Windows Script Chain: The Supply-Chain Trap Behind a RAT Drop
A typosquatted package in the npm ecosystem shows how a single confusing name can hand attackers a path from dependency install to Windows-native execution.
A Lookalike npm Package Turned a Trusted CSS Name Into a Windows Malware Pipe
A deceptive package name in the PostCSS orbit shows how open-source trust can be abused before any code ever reaches production.
GitHub as a Malware Conveyor Belt: What a 10,000-Repo Abuse Case Reveals
A large repository-abuse campaign puts a hard truth in focus: on code-sharing platforms, reputation can be weaponized as easily as code.
Search Ads, Hidden Code, and a Loader Built to Dodge the First Look
OXLOADER shows how a malicious click path can be paired with compiler-style obfuscation to make a Windows infection chain harder to inspect before it runs.
When the IDE Becomes the Infiltration Layer
GlassWorm puts a sharp edge on a familiar risk: developer tools can become trusted delivery points for stealthy code, hidden text, and hard-to-block command channels.
The Quiet Enemy in Your Keyboard: How Keyloggers Hide Across Every Layer
A practical detection guide becomes a reminder that keystroke theft is not one trick but a stack of tactics, from software hooks to physical implants.
Vidar’s New Trick Turns Chrome’s Secret Defense Into a Process Game
A reported APC-injection bypass shows how infostealers may be shifting from simple cookie theft to more evasive Windows process abuse as browser protections harden.
When a Community Repository Turns Hostile, Every Build Becomes a Risk
Arch’s AUR was reported hit by malware starting June 11, with more than 1,500 packages caught in the blast radius and the real lesson landing on trust, not just infection.
Why a Massive WordPress Cleanup Matters More Than a Takedown
Dutch-led action against SocGholish-linked infrastructure and 14,971 infected WordPress sites points to a deeper fight over the web delivery layer that attackers rely on.
CryptoBandits Turns a Crypto Stealer Into a Hidden Remote-Control Tool
The malware’s use of Tor and a local SOCKS5 proxy suggests a design built for both wallet theft and quieter operator tasking, a combination that complicates endpoint defense.
When a Review Badge Turns Into a Browser Trap
A reported injection into a widely used e-commerce reviews widget shows how a trusted storefront component can become a client-side risk surface.
SocGholish Hit in a Coordinated Sweep, but the Loader Era Is Not Over
A multinational disruption of 106 servers and 101 domains shows how much modern malware depends on fragile web infrastructure, not just code on disk.
When a Teams Relay Becomes a Blind Spot for Ransomware Operators
A DragonForce-linked operation reportedly used a custom backdoor to route command traffic through Microsoft Teams infrastructure, showing how trusted collaboration services can be repurposed as cover.
Shortcut Trap, Script Chain: The Quiet Route From a Fake Tool Search to an In-Memory RAT
A Windows shortcut, a PowerShell downloader, and a ClickFix-style lure can turn a routine search for AI tools into a stealthy intrusion path.
The CAPTCHA Trap That Turns a Browser Check Into a Malware Dropper
A counterfeit verification flow and a fake Windows crash screen show how modern malware campaigns are shifting the first click from code to psychology, with SmartRAT as the reported payload.
Resume Bait, Shortcut Clicks, Hidden Loaders: The Windows Trick Behind Xctdoor
A campaign built around job-application lures shows how a plain-looking .LNK file can become the first step in a stealthy Windows execution chain.
When Android Malware Becomes a Product: Why BTMOB Matters Beyond the Payload
BTMOB is a reminder that the most dangerous mobile threat is often not a single exploit, but a packaged service that turns malware creation into a repeatable business.
Namespace Trust Broke First: The npm Supply Chain Story Hidden Inside Mastra
More than 140 packages in the Mastra namespace were reported as part of a supply-chain compromise, with a typosquatting dependency, easy-day-js, used in a way that could fit install-time malware delivery.
The Plugin Trap: How a Helpful AI Tool Can Turn Into a Secret Stealer
A batch of JetBrains add-ons posing as AI coding assistants highlights a familiar weakness in modern development: once a plugin is trusted, it may inherit far more access than users realize.