IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Steam Help Threads Became a Trapdoor for Cryptomining
A support-seeking gamer can become the execution step in a ClickFix lure, turning a forum reply into a path for XMRig and silent resource theft.
Fake Crypto Pages, Real Risk: How Browser JavaScript Can Assemble Malware in Memory
A malvertising run dressed up as Solana, Luno, and TradingView shows how a browser can be turned into part of the delivery chain, not just the place where victims land.
Scripted and Hidden: The Phantom Stealer Chain Riding on Business Trust
A phishing lure impersonating a logistics workflow and a two-step script chain show how credential theft now depends less on flashy exploits and more on ordinary Windows tools.
When the Browser Becomes the Payload Factory
A malvertising chain tied to trading and crypto lures shows how ServiceWorkers and SharedWorkers can be repurposed for runtime assembly inside the browser, complicating file-based defense.
Dolphin X Turns Infection Into a Sorting Problem for Attackers
The Windows malware family reportedly pairs broad secret theft with an "AI Profiler" that scores infected PCs, making it easier for criminals to focus on the hosts that look most valuable.
The Search Result That Opened the Door to a RAT
A malvertising chain that mimicked Claude Desktop and ran through Bing Ads shows how a trusted software search can become a post-exploitation problem almost instantly.
WARDEN’s Forum Pitch Turns Browser Secrets Into a Criminal Product
A newly advertised Windows stealer service points to a familiar but evolving threat model: attackers want browser sessions, wallet access, and reusable credentials more than they want a single password.
Inside the Lampion Lure: A Malware Chain Built to Look Ordinary
A Portuguese phishing run shows how attackers can hide a serious payload behind routine mail, layered scripts, and a trusted Windows launcher.
Lampion’s Portugal Trap: Why a 750MB Lure Can Still Begin With a Simple Email
The campaign highlights how localized phishing, staged scripts, and possible remote-access payloads can turn ordinary inbox traffic into a layered intrusion path.
RubyGems Became a Quiet Mining Lane, and SSH Was the Second Door
A cluster of malicious Ruby packages points to a familiar pattern in modern supply-chain abuse: trusted installs can become execution points, and trusted remote access can become a spread path.
TrickBot Quietly Rewired the Oldest Trick in the Book: DNS as a Remote Control Line
A new TrickBot variant points to a familiar criminal playbook: hide commands in normal-looking DNS traffic, then lean on Windows scheduled tasks and modular payloads to stay alive.
When Trusted Automation Starts Hunting Hosts
Abused GitHub repositories, compromised workflows, and polluted PHP package paths can turn ordinary delivery tooling into coordinated infrastructure for scanning hosting servers.
Dolphin X Bets on Bundled Crime: Credential Theft, Hidden Control, and AI Branding
A marketed Windows malware package is being described as a stealer, a remote-access tool, and a traffic relay in one, but several of its flashier claims remain unverified.
Browser Noise Becomes a Shield for a New Backdoor
msaRAT is reported to route command-and-control traffic through Chrome or Edge, a tactic that can make hostile activity harder to separate from ordinary browsing.
A Fake Json.NET Package Hid a Different Kind of Payload: Outcome Manipulation
A near-match NuGet package disguised as a trusted .NET dependency, turning supply-chain trust into a narrow, target-specific integrity risk.
Telegram-Controlled Tooling Blends WiFi Credential Hunts With Network Flooding
A reported Python framework ties together wireless credential extraction, disruption, proxy use, and DDoS-style traffic, showing how a single script can mix access, control, and impact.
Inside the Shadow Market for Windows Evasion: A Crypter Built to Disappear
A reported Mono-based crypter marketed on underground forums is said to combine BYOVD and process ghosting, a pairing that can make RAT and infostealer delivery harder to spot and slower to investigate.
When a Calendar Becomes a Control Plane: HollowGraph and the Quiet Abuse of Microsoft 365
A malware component reported to use a compromised Microsoft 365 calendar as a two-way dead-drop shows how trusted collaboration tools can be turned into covert command channels.
Telegram as a Quiet Control Room: The Malware Chain That Hid Behind Normal Messaging
A newly described intrusion set used Telegram bots for command and control, then layered in obfuscation and environment-bound payloads to make analysis and detection harder.
When a Build Workflow Turns Hostile: The AsyncAPI npm Incident
A malicious release surfaced in a trusted package path, showing how compromised automation can turn software delivery into a malware channel.