IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
WordPress Backdoor Turns a Trusted Plugin Path into a Hidden Ethereum-Controlled Beacon
A cleanup uncovers malware that lives inside WordPress’s always-on mu-plugin system while using Ethereum smart contracts as a lookup layer for command-and-control.
From Movie Downloads to Malware Control: How a Torrent Lure Learned to Hide in Blockchain Traffic
MovieReaper shows how a familiar pirate-download trap can be paired with a resilient resolver layer, making malware harder to disrupt once it lands on a victim machine.
A Familiar Name, a Hidden Trigger: The npm Package That Waited to Run
A lookalike JavaScript dependency reportedly blended into normal application code instead of install hooks, a design that can slip past defenses built only for package setup time.
MQTT Turned into a Backdoor: BambooToken’s Linux Build Points to a Quiet Control Plane
A Linux malware variant is using a legitimate messaging protocol for remote commands and file movement, showing how control traffic can hide inside ordinary brokered communication.
A Package That Looked Clean Until It Ran
A malicious npm package called indexed-btree illustrates a sharper supply-chain trick: hiding bad behavior in normal runtime code, beyond the reach of install-script checks.
PowerShell’s Quiet Heist: What TASK#STOMP Reveals About Data Theft on Windows
A reported PowerShell backdoor campaign shows how attackers can turn ordinary Windows features into a low-noise collector for documents, credentials, and screenshots.
Profile Data as a Hidden Mailbox: ROOFDECK Turns a Public Protocol into Malware Rendevous
A macOS backdoor tied to a GitHub job-lure chain shows how attackers can use ordinary-looking profile metadata to mask command-and-control infrastructure.
When the Blockchain Becomes the Backdoor
A malware campaign is using Polygon as a mutable control layer, showing how public blockchain infrastructure can be repurposed to steer theft without constantly rewriting the victim-side payload.
RatHat Turns Android’s Trust Features Into a Banking Trap
A newly described Android banking Trojan is built around permission abuse, overlay tricks, and wireless debugging, showing how everyday phone features can be chained into credential theft.
Windows, Hiding Places, and a Miner: The Malware Chain Built to Evade Easy Detection
A cryptomining operation reportedly stitched together PowerShell, the Registry, DNS TXT records, and disguised media files to deliver XMRig on Windows systems.
Hidden in Plain Windows: The PowerShell Loader Chain Feeding XMRig
A cryptomining operation is using PowerShell, registry data, DNS TXT records, and media files to mask the path to an XMRig miner.
The Hidden Trap in Trusted Widgets: How One Embed Can Become a Malware Pipeline
A suspected Brevo-related supply-chain abuse case shows how one upstream web dependency can turn ordinary forms and chat boxes into a broad malware delivery path, especially when social engineering is added to the mix.
When a Chat App Becomes a Spy Rig: Telegram’s Role in the Chosen Brick Case
US, UK, and Dutch agencies published a joint look at Chosen Brick, a surveillance malware case that underscores how ordinary messaging services can be bent into command channels.
Noodle RAT Turns the Windows-Linux Divide Into a Blind Spot
A cross-platform backdoor family with long-running aliases shows how one implant can blur attribution, persistence, and detection across mixed estates.
Rental Malware Is Getting a Better Sales Pitch: VectraRAT and the Windows Trust Gap
A newly documented Windows malware service is being framed as a low-cost package for privilege bypass and credential theft, a reminder that cybercrime now sells convenience as much as capability.
Noodle RAT’s Real Trick Is Not Speed - It Is Looking Routine
This cross-platform backdoor leans on built-in Windows and Linux scheduling features, then uses process camouflage to make long-term access harder to spot.
RubyGems at the Edge of Automation: Why a Package Flood Became a Trust Problem
A reported wave of 3,022 malicious RubyGems packages shows how registry metadata, docs processing, and publish APIs can become a high-volume abuse path, while AI attribution remains unproven.
Casbaneiro’s Hidden Gate: Why a Banking Trojan with Split-Path C2 Matters
A Latin America-focused malware run shows how geography checks, phishing lures, and dispersed command-and-control can turn a familiar banking trojan into a harder target for defenders.
Trusted Windows Tools, Untrusted Emails: The mshta.exe Trap Hiding in Plain Sight
A phishing chain built around a legitimate Windows binary shows how legacy script runners can become a quiet entry point for reconnaissance and credential-focused malware.
KATARU Shows How Old IoT Weaknesses Still Power New Botnets
A newly observed malware family chains Telnet password guessing, Linux privilege escalation attempts, and DDoS enrollment into one automated workflow.