IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
A Package Worm, a Stolen Login, and a Supply Chain That Keeps Spreading
A reported IronWorm campaign puts malicious npm packages, GitHub access, and developer credentials in the same attack path, with crypto and web3 teams in the crosshairs.
Mac Ads as an Entry Point: FlutterShell Shows How a Click Can Become a Trust Problem
Malicious advertising is being used to push a macOS backdoor, and the case highlights how social engineering can be more effective than a direct exploit.
When a Build File Turns Into a Delivery Route for npm Poisoning
A rapid package-chain incident shows how native build plumbing and install-time hooks can turn trusted developer workflows into a supply-chain risk.
Fake ChatGPT Downloads Turn Search Traffic Into a Malware Trap
A spoofed ChatGPT download page, pushed through sponsored results, shows how brand trust and paid search can be combined into a cross-platform delivery channel for malware.
When a Mod Looks Like a Trap: WeedHack Turns Minecraft Curiosity into Malware Delivery
A Minecraft-focused malware campaign is using fake mods, search manipulation, and tutorial videos to pull players toward malicious Java archives.
Chrome’s Friendly Mask: How a Wallpaper Hook Became a Browser Risk
A cluster of deceptive Chrome extensions turned a familiar marketplace into a trust test, showing how browser add-ons can become a high-leverage attack surface when permissions are granted too casually.
When a Mod Becomes a Trap: The Minecraft Malware Pipeline Behind Weedhack
A Minecraft-focused malware campaign shows how game communities, video platforms, and fake software downloads can be stitched into a single infection chain.
Purchase-Order Traps Are Turning JavaScript Into a Quiet Enterprise Backdoor
A procurement-themed .js attachment can become a foothold on Windows, showing how a routine inbox task can turn into execution, persistence, and remote control.
Package Trust, Broken Open: The TrapDoor Playbook Inside Developer Workflows
A cross-registry supply chain campaign shows how ordinary package installs can turn into secret-harvesting events for cloud, SSH, and wallet credentials.
TrapDoor and the Quiet Theft Path Hidden Inside Trusted Package Installs
A reported cross-registry package campaign shows how ordinary install and build workflows can become secret-harvesting channels for developer systems.
Trusted Names, Rogue Releases: The npm Supply Chain Trap Hidden in Plain Sight
Malicious versions pushed into the @redhat-cloud-services namespace show how a familiar package name can become a credential-harvesting path for developers and CI/CD systems.
When npm Trust Becomes the Attack Path: A Credential-Stealing Worm Reaches the Release Line
A compromise in the package publication chain can turn trusted automation into a delivery system for secret theft and repeat infection.
17 Million Infected Devices, One Choke Point: Inside a Botnet Disruption
Dutch authorities say they disrupted a botnet tied to at least 17 million infected devices, a case that shows how control infrastructure, not just endpoints, can become the fastest path to damage reduction.
The Fake RVTools Trap: How a Trusted Installer Can Smuggle in a Backdoor
A counterfeit VMware utility, a legitimate code-signing certificate, and a staged Python payload show how attackers can turn reputation into an entry point.
Windows Consoles in the Crosshairs: Why .MSC Files Have Become a Stealthy APT Tool
A familiar Microsoft administration format is being treated as a low-friction execution path, and that matters because trusted system tools are often the hardest ones to watch.
Windows Trust, Weaponized: PureLogs, MSBuild, and the Quiet Art of Process Hollowing
A reported PureLogs campaign blends phishing attachments, a legitimate Microsoft build tool, and memory-injection tradecraft to target credentials and wallet data.
When Malware Starts Renting Space on a Blockchain
ClearFake’s use of EtherHiding on BNB Smart Chain testnet smart contracts shows how on-chain storage can complicate the hunt for command-and-control infrastructure.
Fake Interviews, Real Theft: How InvisibleFerret Turns Developer Trust Into an Entry Point
Developer job lures are being used to deliver InvisibleFerret, a malware family tied to browser credential theft, crypto wallet targeting, and risky access to CI/CD environments.
When a Build Tool Becomes Cover: The PureLogs Campaign Hiding Behind MSBuild
A phishing lure dressed as a purchase order is being paired with MSBuild abuse and process hollowing, a combination that turns ordinary Windows trust into a stealth path for infostealer activity.
BTMOB Pushes Android Malware Beyond Theft and Into Remote Control
A newly observed Android RAT is drawing attention because its value is not just in stealing data, but in giving an operator practical control over a victim’s phone once it is installed.