IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
Fake Zoom Installer Turns a Trusted Mac Workflow Into a Malware Gate
A brand-masquerade installer, a native macOS binary, and a .NET stage show how ordinary software trust can be turned into a delivery path for remote-control malware.
The Registry Trap Hiding Inside AI Coding Help
A fast-moving npm campaign linked to WEL1DROPPER shows how package names themselves can become the attack surface when developers trust AI-suggested dependencies.
Fake Zoom Installers, Real Cross-Platform Risk: The Loader Trick Security Teams Keep Missing
A malware campaign tied to a Zoom-branded installer shows how a familiar software path can be repurposed to move the same threat across macOS and Windows.
TeamPCP’s Trail May Start in Redis, But the Bigger Risk Is Trust Itself
Analysts link the same threat cluster to Redis-related abuse dating back to 2020 and to a later supply-chain campaign, a pattern that raises the stakes from exposed infrastructure to trusted software paths.
Router Firmware, Hidden Control: Why a Boot-Time Implant Changes the Threat Model
A reported factory-installed backdoor in Zbtlink routers highlights how trust at the network edge can be undermined before a device even leaves the box.
Roblox Cheat Lure Turns Desktop into a Rapid-Fire Spy Feed
A fake “undetected” executor aimed at Roblox players shows how gaming trust can be converted into endpoint surveillance and remote control.
When Malware Skips the Name Game, Defenders Lose Their First Warning
Unit 42 measured a large share of C2-active malware that connected straight to IP addresses, sidestepping DNS and the visibility layer many security teams still depend on.
Inside the npm Poisoning Run: Why Stolen Publish Secrets Can Become a Malware Multiplier
A campaign tied to more than 400 npm packages shows how credential theft, package automation, and install-time trust can combine into a fast-moving supply chain threat.
Botnets Are Knocking on Router Diagnostics - and Looking for a Shell
Repeated probing of router test pages points to a familiar edge-device risk: a harmless-looking diagnostic field can become dangerous if user input reaches backend commands unsafely.
Fake Roblox Executor Turns a Cheat Hunt Into a Malware Delivery Trap
A lure built around an “undetected” Xeno-style executor is being used to push a Java RAT through gaming communities that users often treat as low-risk.
Fake AI Downloads Are Becoming a Shortcut to Stolen Developer Trust
Attackers are using AI-branded lures and cloned GitHub repositories to push infostealers toward developers and AI users, with credentials and cloud secrets in the crosshairs.
Fake AWS Logins, Real Exploit Code: The iOS Trap Hidden in Plain Sight
A cluster of spoofed cloud sign-in pages and a leaked exploit kit shows how one web estate can blur the line between credential theft, staging, and mobile compromise.
Inside the Android Box: A Dual-Use Fraud Engine Hiding in Plain Sight
Low-cost media players can become identity-spoofing fraud nodes and, under certain conditions, SOCKS5 relays that route third-party traffic through home broadband.
Cybercrime Learns to Speak AI, and Ransomware Learns to Silence Defenses
A threat report points to attackers folding AI abuse, QR lures, and defensive evasion into a more adaptable playbook.
BlackTech Links BlueShell to a Fresh Linux Foothold in Japan-Focused Operations
A public-source RAT can become a quiet post-compromise tool when operators reshape it for Linux environments and long-haul access.
The Fake Kernel Thread That Could Fool a Linux Admin
A reported BlueShell variant hides behind a kworker-style name on Linux, turning process masquerade into a stealth tool for post-compromise access.
Brazil’s Banking Malware Finds a New Shortcut Through WhatsApp Web
Astaroth has added a WhatsApp Web spambot module, shifting from classic phishing lanes toward a messaging channel that can be abused to push malware from infected machines.
Linux Login Plumbing Turns into a Hiding Place for a Cryptominer
A reported Monero mining operation used PAM-related abuse on Linux to make its activity harder to spot, showing how authentication code can become a persistence layer instead of a safeguard.
AtlasRAT Turns Windows Into a Harder Target by Hiding Its Tracks in Encrypted Traffic
A newly documented RAT combines staged loading, encrypted command traffic, and modular add-ons, pushing defenders away from simple file hunting and toward behavior-based detection.
Three Drivers, One Backdoor: The Quiet Power of Kernel Trust Abuse
A reported campaign against a Japanese industrial manufacturer shows how BYOVD tradecraft can turn signed drivers into a path toward persistent remote access.