IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
When a Linux Rootkit Turns the Sensor Against Itself
A research demo against Elastic Defend highlights a harder problem for Linux security: if the kernel telemetry path can be tampered with, the alert may never fire.
The Backdoor That Sleeps in a Trusted Agent Until the Right Packet Knocks
SLEEPWALKER shows how Windows DLL side-loading and trigger-based activation can turn a normal management process into a stealthy hiding place.
SLEEPWALKER Turns the Usual Malware Playbook Inside Out
This Windows backdoor does not appear to live on noisy beaconing alone - it can wait for a trigger, then move tasking through DNS, VMware VMCI, named pipes, and memory-only execution paths.
When Trust Becomes the Payload: ValleyRAT’s Quiet Infiltration of a Signed Utility
A Windows backdoor linked to Silver Fox was disguised inside a signed wallpaper app, turning software trust and antivirus exclusions into part of the intrusion path.
Fake CAPTCHA, Real Foothold: How TerminalFix Turns a Simple Paste Into Internal Reach
A ClickFix-style campaign uses brand impersonation, PowerShell, DLL sideloading, and hidden payloads to push compromised Windows hosts toward proxy-like access inside a network.
GitHub, Scripts, and a Trusted Windows Utility Form a Quiet Malware Conveyor Belt
A reported loader chain tied to Blind Eagle combines public code hosting, VBScript, PowerShell, and InstallUtil to place AsyncRAT on Windows systems.
Gryxa’s Quiet Trick: A Toolkit That Keeps Reading the Cleanup
The intrusion set is reported to use legitimate RMM software, steal browser credentials, and leave behind a surviving component that can collect Windows logs and host artifacts after visible removal.
Gryxa and the New Logic of Cleanup Resistance
A Windows toolkit tied to financially motivated activity shows how abuse of legitimate remote access, browser credential theft, and layered persistence can turn incident response into a moving target.
The Operator Got Burned: How One Infostealer Opened a Window Into a Malware Workshop
A compromised attacker-side workstation offered a rare look at the moving parts behind a suspected Blind Eagle-related operation, showing how phishing, loaders, and scripting tools can sit behind a single campaign.
Fake CAPTCHA, Real Shell: The ClickFix Lure Turning Windows Into a Tunnel
A reported TerminalFix campaign uses counterfeit Cloudflare-style prompts to push users into running PowerShell, then drops a reverse-tunnel implant that can turn an endpoint into a pivot point.
Ethereum Became the Backup Line for a New Go Malware Framework
A newly identified Go-based payload appears to use smart contracts as a resilient fallback channel, a design that can complicate takedowns and attribution.
SLEEPWALKER Stays Quiet Until the Packet Arrives
A Windows backdoor built around packet-gated activation, DLL side-loading, and in-memory execution shows how some implants are designed to challenge egress-focused defenses rather than overwhelm them.
When the Dashboard Joins the Botnet
Android-based car head units are drawing criminal attention for a simple reason: they are internet-connected computers that can be repurposed for traffic relay, not just entertainment.
AI Helps Malware Move Faster, But Most Samples Still Die Before First Contact
A large malware sample set tied to AI shows a familiar cyber pattern: faster authoring does not automatically translate into better real-world execution.
Fake CAPTCHA, Real Shellcode: How English Words Became a Malware Delivery Trick
A ClearFake-linked chain described by researchers turns trusted websites and human curiosity into a route for WordlistLoader and Amatera Stealer.
When Malware Starts Drafting Its Own Commands
ToxNetV2 is described as a peer-to-peer Linux botnet whose controller feeds telemetry into a large language model to propose shell, SSH, and file-handling actions.
When a Framework Turns Into a Botnet Highway
A reported burst of exploitation against Next.js deployments shows how quickly a web app flaw can be converted into credential theft, proxy abuse, and persistent control.
PavinLoader’s Quiet Trick: How a Trusted Build Tool Becomes a Malware Conveyor Belt
A multi-stage loader linked to fake installers, ClickFix lures, and game-themed packages shows how attackers can hide malicious activity inside ordinary Windows workflows.
Fake Minecraft Downloads Turn Search Results Into a Malware Delivery Lane
WeedHack is still reaching gamers through lookalike sites and suspicious downloads, showing that disrupting command infrastructure does not automatically stop the distribution chain.
SynkLoader Revives an Old Trick With Fresh Criminal Ambition
A multilingual malware family is being linked to screen hijacking and password theft, while a possible ransomware connection remains unconfirmed.