IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Millenium RAT Hides Its Tracks in a Native C++ Build and Telegram-Borne C2
The malware’s latest variant pairs resource-embedded settings with Base64 and XOR obfuscation, making its control plane harder to spot without deeper binary triage.
Millenium RAT v4.* Shifts to Telegram-Controlled Windows Tasking
A Windows remote-access trojan tied to a MaaS model is being linked to Telegram Bot API tasking and a move away from .NET toward native C++ code.
Archive Lure, Secret Harvest: Why a WinRAR-Based Stealer Chain Deserves More Attention
A reported GIFTEDCROOK campaign shows how a seemingly ordinary archive can be turned into a delivery path for browser, vault, VPN, and document theft.
Fake Safety, Real Theft: Rokarolla Turns Android Trust Into a Banking Trap
A counterfeit Google Play Protect lure shows how mobile malware can use familiar brands, accessibility abuse, and overlays to pressure users into handing over financial access.
Chrome’s Cookie Shield Meets a Rust-Built Burglar
A tracked infostealer family kept changing shape, and its latest move highlights how browser protections and session theft are locked in a race that defenders cannot afford to lose.
The Quiet Theft Model: How a Rust Infostealer Turns Browser Trust Into Account Risk
KuinaExtractor, a reported Rust-based infostealer also linked to the name k0to, highlights a familiar but dangerous pattern: steal the browser state, and you may steal the session.
Chrome’s Trust Model Becomes the Attack Surface in a Windows Extension Campaign
A campaign abusing policy-controlled installs and Native Messaging shows how a browser can be turned into a command relay when trusted management features are misused.
Operation Endgame Hits the Service Layer Behind Amadey and StealC
A coordinated disruption against criminal infrastructure shows how botnets and infostealers depend on fragile command systems, not just malware code.
npm Lookalikes Put PostCSS Trust Chains on the Hook for Chrome Passwords
A deceptive package name can be enough to turn a routine JavaScript install into a staged Windows malware chain with browser-credential risk.
The Storefront Trap: How a Fake Android Document Reader Slipped Past the Guardrails
A disguised document-reader app on Google Play reportedly drew more than 100,000 downloads, showing how trust in a familiar storefront can outlast automated checks.
When a Browser Add-On Crosses the Line Into Host Control
A malicious Edge extension linked to a Python backdoor shows how native messaging can turn a browser convenience feature into a bridge toward endpoint-level abuse.
The Access Broker Problem: Why a New RAT Matters More Than a Single Malware Name
Mistic RAT is the latest reminder that ransomware often begins long before encryption, inside a market where footholds can be traded across multiple criminal crews.
Fake PostCSS Packages Turned a Routine npm Install into a Windows RAT Risk
Three lookalike npm packages aimed at frontend developers underscore how package-name trust and installer-time execution can collide on a developer workstation.
Inside the Windows Trapdoor: A Shortcut, a Public Folder, and a Memory-Resident RAT
A lure built around a geopolitical theme masked a loader chain that leaned on user execution, writable paths, and trusted Windows components to keep the final payload off disk.
When a Windows Helper Becomes the Hideout
A legitimate Microsoft binary, a sideloaded DLL, and a memory-resident RAT show how attackers can turn normal loader behavior into a stealth delivery path.
Fake Popularity, Real Theft: The Clip-on Trap Hiding Behind GitHub Stars and VirusTotal Votes
A deceptive trust layer is being abused to make a crypto clipper look safer than it is, turning stars, reviews, and clipboard swaps into a quiet route to theft.
Sponsored Search, Silent Loader: How a Fake Ad Chain Turns Into Credential Theft
A newly described malware loader, OXLOADER, shows how a simple ad click can become a staged delivery path for CastleStealer and other credential-grabbing payloads.
Rokarolla and the Android Trap: When a Banking Trojan Wants the Whole Phone
The malware family linked to Android banking fraud is interesting not for one trick, but for the way it turns ordinary handset features into a potential control layer for attackers.
Old Router Flaws, New Quiet Threat: AryStinger Turns Edge Devices Into Reconnaissance Nodes
A malware family built for scanning, tunneling, and persistence shows how long-forgotten router bugs can still power a modern access network.
Forgotten Edge Devices, New Operator Tricks: AryStinger’s Quiet Relay Game
A newly analyzed botnet turns aging routers and NAS appliances into scanning and tunneling nodes, showing how small edge devices can become useful infrastructure for hiding attacker origin and widening reach.