IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
When a Trusted SDK Turns Toxic: The Tensorlake npm Compromise and the Hidden Risk in AI Toolchains
A tainted Tensorlake package in npm is a reminder that software supply chains can turn into credential traps long before defenders notice the first suspicious request.
When Phishing Hides Its Trail in Public Blockchains
A malware campaign pairs email lures with Ethereum and TON to refresh command-and-control locations without relying on a fixed server address.
Blockchain as a Hideout: Malware Is Chasing the Secrets Behind the Build
A reported campaign pairing ChainDrop and PolinRider shows how cloud and CI/CD identities can become the real target when malware uses blockchain-based command channels.
Poisoned npm Release Turns a Developer SDK Into a Secret-Harvesting Risk
A compromised Tensorlake package version has been linked to a Shai-Hulud worm variant, sharpening the warning around how fast supply-chain malware can turn cloud and SSH secrets into liabilities.
Guest Complaints Become Malware Traps in a Hotel Phishing Campaign
Accommodation staff are being baited with fake reviews and complaint emails that deliver malware families designed to hide their command-and-control location behind public blockchains.
When the Loader Learns to Hide: MATCHBOIL’s Shift From Dropper to Stealth Tool
A C# downloader tied to UAC-0099 shows how a first-stage implant can be hardened with sandbox checks, obfuscation, and fake windows before the backdoor ever appears.
The Browser Became the Prize: A Malicious Extension Turns Tabs into a Control Surface
A Windows infostealer campaign is abusing Chromium extensions to steal browser data and manipulate what victims see in real time.
Healthcare Intrusion Kept Alive by Telegram and DNS Tricks
A long-running campaign tied to Partisan Zmiy shows how simple transport choices and scheduled execution can keep access alive long after an intrusion should have been found.
Earth Sirrush’s Long Game: A Spy Campaign That Changes Malware, Not Its Habits
Analysts say a Russia-aligned intrusion set has kept pressure on Ukrainian public-sector and defense targets by rotating malware while preserving the same operational patterns.
The ATM Malware Arrest That Exposes a Hidden Cash Pipeline
The reported FBI arrest tied to Ploutus is less about one fugitive and more about how ATM jackpotting blends local access, malware, and organized-crime finance.
npm’s Hidden Trap: A Long-Running MALFEX Campaign Turned Ordinary Installs Into Exposure Events
A supply-chain malware run tied to MALFEX has been active since August 2023, showing how package installs can become security events long before defenders notice.
When a Botnet Dresses Like STUN: Cling’s Quiet War on IoT Defenses
Cling turns a familiar NAT-traversal protocol into cover for command traffic, showing how old embedded-device flaws and ordinary network noise can be fused into one stealth layer.
Cling Botnet Hides Its Orders Inside a Traffic Pattern Defenders Trust
A botnet tied to exposed IoT and networking gear shows how attackers can blend command traffic into a common NAT-traversal protocol and make routine telemetry look harmless.
ClingSTUN Turns Forgotten Linux Boxes Into Silent Proxy Outposts
The malware chain is built for endurance: persistence at boot, concealment in the filesystem, and STUN-based connectivity that helps compromised devices stay reachable through NAT.
Hidden in Plain UDP: Cling Botnet Tries to Ride a Patched Realtek Flaw
Observed exploit attempts against Realtek Jungle SDK components show how edge-device malware can borrow legitimate network behavior to make command traffic look routine.
ClingSTUN Shows How Linux Malware Can Hide in Legitimate Network Noise
A reported Linux backdoor blends proxying, persistence, and self-propagation logic with STUN traffic, creating a detection problem that is more behavioral than signature-based.
When a Theme Turns Toxic: The VS Code Supply-Chain Angle Behind GlassWorm
A seemingly cosmetic editor add-on can become a delivery vehicle when extension packages carry executable code, not just colors.
The Browser Cache Trap: ClickFix Turns a Familiar Web Feature Into a Hiding Place
A Microsoft threat team analysis points to a ClickFix campaign that stashes malicious content in browser cache and dresses it up as a PNG, a reminder that ordinary web plumbing can become attacker cover.
The WordPress Backdoor That Would Not Stay Dead
A malware cluster codenamed SC appears to have survived cleanup by scattering its presence across files, database state, and shared memory, turning removal into a sequencing problem.
Inside SC: The WordPress Malware That Rebuilds Its Own Footholds
A newly studied WordPress malware family uses multiple persistence points across database and runtime layers, so removing one backdoor can still leave the rest ready to repopulate it within seconds.