IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
When the Malware Site Stares Back: SilverFox’s New Trick
A reported SilverFox-linked campaign uses fake software pages that behave differently for researchers and potential victims, turning simple inspection into a moving target.
Fake Software, Real Risk: The Windows Installer Trap That Hides in Plain Sight
A branded download page can look harmless, but counterfeit installers remain one of the cleanest ways to turn routine software hunting into a compromise path.
BotHelper RAT Turns a Windows Screen Into a Remote Window for Spies
A newly documented Windows RAT combines stealth, persistence, and live desktop streaming, showing how a single host can become an operator’s interactive control panel.
Klez Turned Inboxes Into Launchpads and Windows Paid the Price
The 2001 Klez worm shows how a mass-mailing threat can fuse spoofed identity, unsafe email rendering, and file-share spread into one fast-moving infection engine.
When a Laptop Becomes a Login: The Quiet Power of Infostealer Malware
A single infected developer device can spill passwords, API keys, and login tokens into the hands of criminals, turning endpoint theft into cloud and AI access.
Open Docker Registries, Closed Doors: Why a Botnet Wanted AI Keys First
An exposed container registry can become more than a repository problem - it can turn into a secret warehouse that malware can mine for reusable credentials.
PamStealer Pushes macOS Malware Toward Live, Server-Dependent Decryption
A newer PamStealer build appears to make its core payload harder to recover offline, while still leaning on macOS-native scripting and persistence paths that defenders know too well.
MacSync’s Shift to Native Code Raises the Bar for macOS Defenders
A newer MacSync variant reportedly moves beyond AppleScript-heavy delivery, using compiled macOS binaries to deliver an infostealer and a backdoor in a more layered infection chain.
Docker’s Quiet Weak Spot Becomes a Botnet Gateway
Carbonato turns exposed container management into an entry point, then reportedly drops the Hermes Agent framework onto systems that should never have been reachable.
When a Desktop Script Becomes a Backdoor: the Quiet Machinery Behind TASK#STOMP
A Windows Script Host file, a PowerShell backdoor, and a two-server exfiltration setup show how ordinary admin tools can be bent into a durable document-theft pipeline.
Copy, Paste, and Connect: The Windows Loader Turning a Fake Check Into a Hidden Channel
AvisLoader pairs a ClickFix-style lure with Tox-based peer-to-peer command control, a combination that can push defenders beyond simple domain blocking.
Windows Malware Tries a New Trick: Letting AI Models Pick the Next Move
A sample named CLOSEDQUORUM has been described as malware that routes part of its decision-making through up to four AI models, while still aiming at familiar Windows secrets.
Fake Verification, Real Risk: Exvicy’s WordPress Lures Blur the Line Between Trust and Trap
A malware-as-a-service operation is being tied to compromised WordPress sites and a familiar-looking Cloudflare verification flow, with analysts drawing a high-confidence comparison to ErrTraffic.
Mac Wallet Lookalikes Are Becoming Credential Traps
A fake crypto-wallet app impersonating Wavel is being used to spread PamStealer on macOS, showing how trust in desktop finance tools can be turned into a path to stolen secrets.
When Trusted Build Tools Become the Delivery Route for Malware
A supply-chain campaign tied to Graphalgo has moved into Terraform providers and Go modules, showing how attackers can abuse the same automation paths developers rely on every day.
Streaming Lures, Silent Permissions: The Android Trap Behind StreamRat
A fake TV-service ad campaign shows how mobile malware can turn ordinary Android features into a remote-control chain, without needing a flashy exploit.
Poisoned Plumbing: Malware Streaks Into Terraform and Go Supply Chains
A cross-ecosystem package campaign shows how hidden code can ride trusted developer workflows without needing a classic exploit.
WordPress Backdoor Turns a Trusted Plugin Path into a Hidden Ethereum-Controlled Beacon
A cleanup uncovers malware that lives inside WordPress’s always-on mu-plugin system while using Ethereum smart contracts as a lookup layer for command-and-control.
From Movie Downloads to Malware Control: How a Torrent Lure Learned to Hide in Blockchain Traffic
MovieReaper shows how a familiar pirate-download trap can be paired with a resilient resolver layer, making malware harder to disrupt once it lands on a victim machine.
A Familiar Name, a Hidden Trigger: The npm Package That Waited to Run
A lookalike JavaScript dependency reportedly blended into normal application code instead of install hooks, a design that can slip past defenses built only for package setup time.