IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
WhatsApp ZIPs, Windows SYSTEM, and a RAT That Hides in Plain Sight
A staged Windows intrusion uses a chat-delivered archive and a WebSocket command path to push malware into the highest local privilege tier.
When Terraform Becomes the Payload: A Trojanized Provider Turns DevOps Trust Into Risk
A malicious Terraform provider shows how one tainted plugin can turn infrastructure automation into an execution path inside developer and CI/CD environments.
When a Phone Arrives Already Infected, Trust Becomes the First Casualty
A firmware-bundled Android campaign turns low-cost phones into ad-fraud and proxy relays, showing how the real attack surface can begin before first boot.
When iPhone Spyware Learns to Whisper: P7 DarkSword Turns Toward Wallets and Remote Tasking
A newly described DarkSword variant appears built for quieter compromise, with on-device keychain theft, crypto-wallet targeting, and bidirectional control that can complicate detection and response.
When a Cheap Phone Arrives Pre-Tainted: The Hidden Risk Inside Android Firmware
A malware campaign tied to low-cost Android devices shows why the real security boundary may be the factory image, not the app store.
Chrome’s New Shield Meets a More Flexible Stealer
A C# infostealer is drawing attention for pairing browser-secret theft with remote command execution and encrypted, low-volume exfiltration.
Exposed AI Servers Are Becoming the New Workhorses of Crypto Crime
PoeLLM is being used in a cryptomining campaign that turns public-facing AI systems into mining platforms, scanners, and launch points for more abuse.
npm’s Trusted Path, Weaponized: MALFEX Shows How a Package Install Can Become Malware Delivery
A long-running campaign in the npm ecosystem has been linked to malicious packages that delivered RATs and stealers, turning routine dependency installs into a supply-chain risk.
npm’s Trust Layer Becomes a Delivery Route for Windows Malware
A persistent package campaign shows how a familiar developer registry can be used to plant loaders, stealers, and remote-control tools aimed at everyday credentials and crypto secrets.
When a Trusted SDK Turns Toxic: The Tensorlake npm Compromise and the Hidden Risk in AI Toolchains
A tainted Tensorlake package in npm is a reminder that software supply chains can turn into credential traps long before defenders notice the first suspicious request.
When Phishing Hides Its Trail in Public Blockchains
A malware campaign pairs email lures with Ethereum and TON to refresh command-and-control locations without relying on a fixed server address.
Blockchain as a Hideout: Malware Is Chasing the Secrets Behind the Build
A reported campaign pairing ChainDrop and PolinRider shows how cloud and CI/CD identities can become the real target when malware uses blockchain-based command channels.
Poisoned npm Release Turns a Developer SDK Into a Secret-Harvesting Risk
A compromised Tensorlake package version has been linked to a Shai-Hulud worm variant, sharpening the warning around how fast supply-chain malware can turn cloud and SSH secrets into liabilities.
Guest Complaints Become Malware Traps in a Hotel Phishing Campaign
Accommodation staff are being baited with fake reviews and complaint emails that deliver malware families designed to hide their command-and-control location behind public blockchains.
When the Loader Learns to Hide: MATCHBOIL’s Shift From Dropper to Stealth Tool
A C# downloader tied to UAC-0099 shows how a first-stage implant can be hardened with sandbox checks, obfuscation, and fake windows before the backdoor ever appears.
The Browser Became the Prize: A Malicious Extension Turns Tabs into a Control Surface
A Windows infostealer campaign is abusing Chromium extensions to steal browser data and manipulate what victims see in real time.
Healthcare Intrusion Kept Alive by Telegram and DNS Tricks
A long-running campaign tied to Partisan Zmiy shows how simple transport choices and scheduled execution can keep access alive long after an intrusion should have been found.
Earth Sirrush’s Long Game: A Spy Campaign That Changes Malware, Not Its Habits
Analysts say a Russia-aligned intrusion set has kept pressure on Ukrainian public-sector and defense targets by rotating malware while preserving the same operational patterns.
The ATM Malware Arrest That Exposes a Hidden Cash Pipeline
The reported FBI arrest tied to Ploutus is less about one fugitive and more about how ATM jackpotting blends local access, malware, and organized-crime finance.
npm’s Hidden Trap: A Long-Running MALFEX Campaign Turned Ordinary Installs Into Exposure Events
A supply-chain malware run tied to MALFEX has been active since August 2023, showing how package installs can become security events long before defenders notice.