IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
MacSync Turns Mac Trust Into a Trap, Using Fake Fixes to Chase Passwords and Wallets
A macOS stealer campaign built around social engineering shows how copy-paste deception can matter more than a software bug.
When the Web Shell Lives in Memory, the Disk Tells a Lie
A malicious PHP implant tied to F5 BIG-IP APM tampering shows why defenders must check what an appliance serves at runtime, not just what its files look like on disk.
Infostealers Turn AI Coding Assistants Into a Fresh Credential Cache
A familiar malware class is widening its net from browser secrets to local data left behind by AI developer tools, raising the stakes for workstation security.
AI Tools Meet Zero-Click Messaging Risk in a WeChat Worm Demo
A Palo Alto-based security team has put a fast-moving question on the table: when AI helps build exploit code in days, how much warning time do defenders really get?
When a Ring Becomes a Breach: The WeChat Call Path That Could Move Like Malware
A demonstrated zero-click chain on iPhone and Android shows how an incoming call can become an account-takeover path when trust is baked into the wrong part of the app.
Reverse Shells, Not Sliver: The Quiet Windows Foothold Behind a Ransomware Probe
A Windows intrusion tied to a ransomware investigation appears to have relied on reverse shells, credential-theft tooling, service masquerading, and Ethereum-based command control, with one early Sliver readout later corrected.
When a Trusted Registry Turns on Its Users
A redirected module registry can turn ordinary infrastructure automation into a credential risk, especially when Terraform pulls code before anyone notices the path changed.
One Old npm Payload, One Fragile Filter, and a Supply Chain Still on Edge
A known Shai-Hulud npm payload resurfaced after 111 days, putting registry-side malware screening under the microscope and reminding defenders that package installs can be an execution path, not just a download.
Known Malware, New Noise: npm’s Dormant Worm Reappears With a Familiar Fingerprint
A resurfacing malicious npm payload shows how supply-chain threats can return unchanged, turning old indicators into a live operational test for registry defenses and developer hygiene.
When a Remote Support Client Becomes the Delivery Vehicle
Modified ScreenConnect clients are tied to a worm-like campaign that uses backdoored instances to transfer and execute payloads on newly connected clients.
The Malware That Leaves After It Leaves: REVSTEALER’s Hidden Second Act
A Windows stealer that deletes itself may sound like a cleanup success, but the real risk is what remains behind: follow-on code that can suppress defenses and push an infected host into mining duty.
When a Malware Search List Swallows the Developer Stack
A newer Shai-Hulud variant now checks 469 locations for secrets, showing how credential theft is following the sprawl of developer, cloud, and AI tooling.
Trusted Code, Hidden Intent: How Node.js Became a Delivery Path for Targeted Malware
A legitimate JavaScript runtime is being repurposed in targeted intrusions, forcing defenders to look beyond file reputation and toward process behavior.
When a Fake Streaming App Meets Android's Most Dangerous Permissions
A malvertising campaign turned familiar Android features into a control stack for banking fraud, showing how social engineering can be as powerful as code.
A Critical Appliance Flaw Hits the Exploited-Vulnerabilities List as Attackers Chase Shells and Miners
A pre-authentication SSRF in SonicWall SMA 1000 firmware has moved into CISA’s active-exploitation tracker, a sign that edge-device bugs are being turned into live footholds, not just patch notes.
Streaming Lure, Silent Hands: How StreamRAT Turns Android Permissions into Remote Control
A streaming-themed Android campaign shows how a single accessibility grant, paired with VNC-style control, can turn a consumer phone into an operator-driven device.
Fake Download Pages Turn Familiar Brands Into Malware Traps
A counterfeit-software scheme has pushed malicious installers through look-alike download pages, showing how attackers can weaponize trust in common names, official-looking sites, and routine software updates.
When a Blockchain Becomes the Back Office for Malware
A ClickFix-linked campaign shows how attackers can pair user trickery with on-chain infrastructure to rotate command links without relying on a single vulnerable server.
Wallet-Branded Installers Are Becoming Perfect Delivery Vehicles for Browser Theft
A trojanized Exodus wallet installer is being used to drop a modular RAT that focuses on credentials, cookies, and live operator access rather than a quick hit on crypto balances.
Fake Download Pages Became the Door: A Counterfeit Installer Campaign Eyes China’s Workstations
A brand-cloning lure built around familiar software names shows how one mistaken download can turn a routine install into an initial access problem.