IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
DarkSword Raises a Harder Question Than Another Malware Alert
A named iPhone exploit kit, an Android mention, and a sensitive attribution claim point to a deeper problem: mobile targeting is increasingly about delivery paths, not just malicious apps.
When a Trusted GPT Becomes the Bait: ClickFix Turns AI Credibility into Malware Delivery
A reported campaign shows attackers using ChatGPT Custom GPTs as a trust layer, then handing victims off to ClickFix-style lure pages that can lead to remote access malware.
How a Supply-Chain Probe Surfaced a Hidden Malware Framework
NeedyMantis was not confirmed as a supply-chain payload itself, but investigators tracing DAEMON Tools indicators uncovered a modular post-compromise framework built for targeted intrusions.
When the Malware Site Stares Back: SilverFox’s New Trick
A reported SilverFox-linked campaign uses fake software pages that behave differently for researchers and potential victims, turning simple inspection into a moving target.
Fake Software, Real Risk: The Windows Installer Trap That Hides in Plain Sight
A branded download page can look harmless, but counterfeit installers remain one of the cleanest ways to turn routine software hunting into a compromise path.
BotHelper RAT Turns a Windows Screen Into a Remote Window for Spies
A newly documented Windows RAT combines stealth, persistence, and live desktop streaming, showing how a single host can become an operator’s interactive control panel.
Klez Turned Inboxes Into Launchpads and Windows Paid the Price
The 2001 Klez worm shows how a mass-mailing threat can fuse spoofed identity, unsafe email rendering, and file-share spread into one fast-moving infection engine.
When a Laptop Becomes a Login: The Quiet Power of Infostealer Malware
A single infected developer device can spill passwords, API keys, and login tokens into the hands of criminals, turning endpoint theft into cloud and AI access.
Open Docker Registries, Closed Doors: Why a Botnet Wanted AI Keys First
An exposed container registry can become more than a repository problem - it can turn into a secret warehouse that malware can mine for reusable credentials.
PamStealer Pushes macOS Malware Toward Live, Server-Dependent Decryption
A newer PamStealer build appears to make its core payload harder to recover offline, while still leaning on macOS-native scripting and persistence paths that defenders know too well.
MacSync’s Shift to Native Code Raises the Bar for macOS Defenders
A newer MacSync variant reportedly moves beyond AppleScript-heavy delivery, using compiled macOS binaries to deliver an infostealer and a backdoor in a more layered infection chain.
Docker’s Quiet Weak Spot Becomes a Botnet Gateway
Carbonato turns exposed container management into an entry point, then reportedly drops the Hermes Agent framework onto systems that should never have been reachable.
When a Desktop Script Becomes a Backdoor: the Quiet Machinery Behind TASK#STOMP
A Windows Script Host file, a PowerShell backdoor, and a two-server exfiltration setup show how ordinary admin tools can be bent into a durable document-theft pipeline.
Copy, Paste, and Connect: The Windows Loader Turning a Fake Check Into a Hidden Channel
AvisLoader pairs a ClickFix-style lure with Tox-based peer-to-peer command control, a combination that can push defenders beyond simple domain blocking.
Windows Malware Tries a New Trick: Letting AI Models Pick the Next Move
A sample named CLOSEDQUORUM has been described as malware that routes part of its decision-making through up to four AI models, while still aiming at familiar Windows secrets.
Fake Verification, Real Risk: Exvicy’s WordPress Lures Blur the Line Between Trust and Trap
A malware-as-a-service operation is being tied to compromised WordPress sites and a familiar-looking Cloudflare verification flow, with analysts drawing a high-confidence comparison to ErrTraffic.
Mac Wallet Lookalikes Are Becoming Credential Traps
A fake crypto-wallet app impersonating Wavel is being used to spread PamStealer on macOS, showing how trust in desktop finance tools can be turned into a path to stolen secrets.
When Trusted Build Tools Become the Delivery Route for Malware
A supply-chain campaign tied to Graphalgo has moved into Terraform providers and Go modules, showing how attackers can abuse the same automation paths developers rely on every day.
Streaming Lures, Silent Permissions: The Android Trap Behind StreamRat
A fake TV-service ad campaign shows how mobile malware can turn ordinary Android features into a remote-control chain, without needing a flashy exploit.
Poisoned Plumbing: Malware Streaks Into Terraform and Go Supply Chains
A cross-ecosystem package campaign shows how hidden code can ride trusted developer workflows without needing a classic exploit.