IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
Fake Installers, Real Risk: How Brand Clones Turn Windows Downloads Into Entry Points
A malware campaign using counterfeit pages for Microsoft Edge, Kaspersky, and Razer shows how ordinary software-seeking behavior can become an initial-access trap on Windows.
When a Botnet’s Own Mesh Becomes the Trap
A multinational disruption of Sality shows how peer-to-peer malware can be weakened when defenders understand the protocol well enough to interfere with its trust layer.
Sality’s Long Game Interrupted: How Defenders Hit a P2P Botnet Where It Communicates
A 23-year-old malware network was disrupted by targeting the way it finds peers and the web locations it uses to pull payloads.
When the Kernel Goes Quiet: A Rootkit Tactic That Can Starve Linux Defenders of Telemetry
A disclosed bypass tied to the Singularity Linux rootkit shows how module-load visibility, not just files or processes, can become the first thing attackers try to silence.
When a Linux Rootkit Turns the Sensor Against Itself
A research demo against Elastic Defend highlights a harder problem for Linux security: if the kernel telemetry path can be tampered with, the alert may never fire.
The Backdoor That Sleeps in a Trusted Agent Until the Right Packet Knocks
SLEEPWALKER shows how Windows DLL side-loading and trigger-based activation can turn a normal management process into a stealthy hiding place.
SLEEPWALKER Turns the Usual Malware Playbook Inside Out
This Windows backdoor does not appear to live on noisy beaconing alone - it can wait for a trigger, then move tasking through DNS, VMware VMCI, named pipes, and memory-only execution paths.
When Trust Becomes the Payload: ValleyRAT’s Quiet Infiltration of a Signed Utility
A Windows backdoor linked to Silver Fox was disguised inside a signed wallpaper app, turning software trust and antivirus exclusions into part of the intrusion path.
Fake CAPTCHA, Real Foothold: How TerminalFix Turns a Simple Paste Into Internal Reach
A ClickFix-style campaign uses brand impersonation, PowerShell, DLL sideloading, and hidden payloads to push compromised Windows hosts toward proxy-like access inside a network.
GitHub, Scripts, and a Trusted Windows Utility Form a Quiet Malware Conveyor Belt
A reported loader chain tied to Blind Eagle combines public code hosting, VBScript, PowerShell, and InstallUtil to place AsyncRAT on Windows systems.
Gryxa’s Quiet Trick: A Toolkit That Keeps Reading the Cleanup
The intrusion set is reported to use legitimate RMM software, steal browser credentials, and leave behind a surviving component that can collect Windows logs and host artifacts after visible removal.
Gryxa and the New Logic of Cleanup Resistance
A Windows toolkit tied to financially motivated activity shows how abuse of legitimate remote access, browser credential theft, and layered persistence can turn incident response into a moving target.
The Operator Got Burned: How One Infostealer Opened a Window Into a Malware Workshop
A compromised attacker-side workstation offered a rare look at the moving parts behind a suspected Blind Eagle-related operation, showing how phishing, loaders, and scripting tools can sit behind a single campaign.
Fake CAPTCHA, Real Shell: The ClickFix Lure Turning Windows Into a Tunnel
A reported TerminalFix campaign uses counterfeit Cloudflare-style prompts to push users into running PowerShell, then drops a reverse-tunnel implant that can turn an endpoint into a pivot point.
Ethereum Became the Backup Line for a New Go Malware Framework
A newly identified Go-based payload appears to use smart contracts as a resilient fallback channel, a design that can complicate takedowns and attribution.
SLEEPWALKER Stays Quiet Until the Packet Arrives
A Windows backdoor built around packet-gated activation, DLL side-loading, and in-memory execution shows how some implants are designed to challenge egress-focused defenses rather than overwhelm them.
When the Dashboard Joins the Botnet
Android-based car head units are drawing criminal attention for a simple reason: they are internet-connected computers that can be repurposed for traffic relay, not just entertainment.
AI Helps Malware Move Faster, But Most Samples Still Die Before First Contact
A large malware sample set tied to AI shows a familiar cyber pattern: faster authoring does not automatically translate into better real-world execution.
Fake CAPTCHA, Real Shellcode: How English Words Became a Malware Delivery Trick
A ClearFake-linked chain described by researchers turns trusted websites and human curiosity into a route for WordlistLoader and Amatera Stealer.
When Malware Starts Drafting Its Own Commands
ToxNetV2 is described as a peer-to-peer Linux botnet whose controller feeds telemetry into a large language model to propose shell, SSH, and file-handling actions.