IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
Poisoned npm Release Turns a Developer SDK Into a Secret-Harvesting Risk
A compromised Tensorlake package version has been linked to a Shai-Hulud worm variant, sharpening the warning around how fast supply-chain malware can turn cloud and SSH secrets into liabilities.
Guest Complaints Become Malware Traps in a Hotel Phishing Campaign
Accommodation staff are being baited with fake reviews and complaint emails that deliver malware families designed to hide their command-and-control location behind public blockchains.
When the Loader Learns to Hide: MATCHBOIL’s Shift From Dropper to Stealth Tool
A C# downloader tied to UAC-0099 shows how a first-stage implant can be hardened with sandbox checks, obfuscation, and fake windows before the backdoor ever appears.
The Browser Became the Prize: A Malicious Extension Turns Tabs into a Control Surface
A Windows infostealer campaign is abusing Chromium extensions to steal browser data and manipulate what victims see in real time.
Healthcare Intrusion Kept Alive by Telegram and DNS Tricks
A long-running campaign tied to Partisan Zmiy shows how simple transport choices and scheduled execution can keep access alive long after an intrusion should have been found.
Earth Sirrush’s Long Game: A Spy Campaign That Changes Malware, Not Its Habits
Analysts say a Russia-aligned intrusion set has kept pressure on Ukrainian public-sector and defense targets by rotating malware while preserving the same operational patterns.
The ATM Malware Arrest That Exposes a Hidden Cash Pipeline
The reported FBI arrest tied to Ploutus is less about one fugitive and more about how ATM jackpotting blends local access, malware, and organized-crime finance.
npm’s Hidden Trap: A Long-Running MALFEX Campaign Turned Ordinary Installs Into Exposure Events
A supply-chain malware run tied to MALFEX has been active since August 2023, showing how package installs can become security events long before defenders notice.
When a Botnet Dresses Like STUN: Cling’s Quiet War on IoT Defenses
Cling turns a familiar NAT-traversal protocol into cover for command traffic, showing how old embedded-device flaws and ordinary network noise can be fused into one stealth layer.
Cling Botnet Hides Its Orders Inside a Traffic Pattern Defenders Trust
A botnet tied to exposed IoT and networking gear shows how attackers can blend command traffic into a common NAT-traversal protocol and make routine telemetry look harmless.
ClingSTUN Turns Forgotten Linux Boxes Into Silent Proxy Outposts
The malware chain is built for endurance: persistence at boot, concealment in the filesystem, and STUN-based connectivity that helps compromised devices stay reachable through NAT.
Hidden in Plain UDP: Cling Botnet Tries to Ride a Patched Realtek Flaw
Observed exploit attempts against Realtek Jungle SDK components show how edge-device malware can borrow legitimate network behavior to make command traffic look routine.
ClingSTUN Shows How Linux Malware Can Hide in Legitimate Network Noise
A reported Linux backdoor blends proxying, persistence, and self-propagation logic with STUN traffic, creating a detection problem that is more behavioral than signature-based.
When a Theme Turns Toxic: The VS Code Supply-Chain Angle Behind GlassWorm
A seemingly cosmetic editor add-on can become a delivery vehicle when extension packages carry executable code, not just colors.
The Browser Cache Trap: ClickFix Turns a Familiar Web Feature Into a Hiding Place
A Microsoft threat team analysis points to a ClickFix campaign that stashes malicious content in browser cache and dresses it up as a PNG, a reminder that ordinary web plumbing can become attacker cover.
The WordPress Backdoor That Would Not Stay Dead
A malware cluster codenamed SC appears to have survived cleanup by scattering its presence across files, database state, and shared memory, turning removal into a sequencing problem.
Inside SC: The WordPress Malware That Rebuilds Its Own Footholds
A newly studied WordPress malware family uses multiple persistence points across database and runtime layers, so removing one backdoor can still leave the rest ready to repopulate it within seconds.
DarkSword Raises a Harder Question Than Another Malware Alert
A named iPhone exploit kit, an Android mention, and a sensitive attribution claim point to a deeper problem: mobile targeting is increasingly about delivery paths, not just malicious apps.
When a Trusted GPT Becomes the Bait: ClickFix Turns AI Credibility into Malware Delivery
A reported campaign shows attackers using ChatGPT Custom GPTs as a trust layer, then handing victims off to ClickFix-style lure pages that can lead to remote access malware.
How a Supply-Chain Probe Surfaced a Hidden Malware Framework
NeedyMantis was not confirmed as a supply-chain payload itself, but investigators tracing DAEMON Tools indicators uncovered a modular post-compromise framework built for targeted intrusions.