IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Trusted Names, Rogue Releases: The npm Supply Chain Trap Hidden in Plain Sight
Malicious versions pushed into the @redhat-cloud-services namespace show how a familiar package name can become a credential-harvesting path for developers and CI/CD systems.
When npm Trust Becomes the Attack Path: A Credential-Stealing Worm Reaches the Release Line
A compromise in the package publication chain can turn trusted automation into a delivery system for secret theft and repeat infection.
17 Million Infected Devices, One Choke Point: Inside a Botnet Disruption
Dutch authorities say they disrupted a botnet tied to at least 17 million infected devices, a case that shows how control infrastructure, not just endpoints, can become the fastest path to damage reduction.
The Fake RVTools Trap: How a Trusted Installer Can Smuggle in a Backdoor
A counterfeit VMware utility, a legitimate code-signing certificate, and a staged Python payload show how attackers can turn reputation into an entry point.
Windows Consoles in the Crosshairs: Why .MSC Files Have Become a Stealthy APT Tool
A familiar Microsoft administration format is being treated as a low-friction execution path, and that matters because trusted system tools are often the hardest ones to watch.
Windows Trust, Weaponized: PureLogs, MSBuild, and the Quiet Art of Process Hollowing
A reported PureLogs campaign blends phishing attachments, a legitimate Microsoft build tool, and memory-injection tradecraft to target credentials and wallet data.
When Malware Starts Renting Space on a Blockchain
ClearFake’s use of EtherHiding on BNB Smart Chain testnet smart contracts shows how on-chain storage can complicate the hunt for command-and-control infrastructure.
Fake Interviews, Real Theft: How InvisibleFerret Turns Developer Trust Into an Entry Point
Developer job lures are being used to deliver InvisibleFerret, a malware family tied to browser credential theft, crypto wallet targeting, and risky access to CI/CD environments.
When a Build Tool Becomes Cover: The PureLogs Campaign Hiding Behind MSBuild
A phishing lure dressed as a purchase order is being paired with MSBuild abuse and process hollowing, a combination that turns ordinary Windows trust into a stealth path for infostealer activity.
BTMOB Pushes Android Malware Beyond Theft and Into Remote Control
A newly observed Android RAT is drawing attention because its value is not just in stealing data, but in giving an operator practical control over a victim’s phone once it is installed.
When a Single Image Can Become a Payment Scam on Older iPhones
A reported zero-click chain linking WhatsApp for iOS and Apple’s ImageIO framework highlights how legacy iPhones can turn a chat app into a stealthy fraud surface.
Ghost CMS Poisoned Pages Turn Trusted Sites Into ClickFix Traps
A reported Ghost CMS exploitation chain shows how one web publishing flaw can be turned into a browser-based lure that blends legitimate pages with malicious JavaScript.
When Tags Turn Toxic: The Laravel-Lang Poisoning Case and the Hidden Risk in CI
Malicious package tags published in a short window turned a routine dependency path into a potential route for stealing build-time secrets.
Search Results Became the Bait in a New Software-Download Ambush
A lure built around SQL Developer shows how a threat cluster can turn user search intent into a delivery channel for malware, without relying on email at all.
Compiled Python, Fake Interviews, and the New Shape of Developer Bait
A malware campaign described through InvisibleFerret shows how recruiting lures and native-looking Python artifacts can collide inside a developer workflow.
Fake AI Tool Downloads Turn Search Results Into a Developer Trap
A lure built around Gemini CLI and Claude Code shows how SEO poisoning can funnel developers toward a fileless PowerShell infostealer.
A Quiet Dependency Turned Into a Credential Trap
A compromise in several Laravel-Lang PHP packages shows how a low-profile update path can become a high-trust delivery channel for credential theft.
Old Router Flaws, Fresh Botnet Power: Why a 2018 ASUS Bug Still Matters
A long-known authentication flaw in ASUS routers has reappeared as a useful tool for RondoDox, showing how stale edge-device bugs can still fuel modern botnet campaigns.
When a Windows Shortcut Becomes a Scanner Trap
A junction-based traversal trick shows how ordinary NTFS features can turn recursive endpoint inspection into a reliability problem.
Arrest in a Botnet Case Exposes the Business Logic Behind DDoS Crime
A Canadian arrest tied to the Kimwolf matter highlights how botnets turn weakly protected devices into rented traffic weapons, and why the legal fight is now as important as the malware itself.