IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
MacSync Turns Mac Trust Into a Trap, Using Fake Fixes to Chase Passwords and Wallets
A macOS stealer campaign built around social engineering shows how copy-paste deception can matter more than a software bug.
When the Web Shell Lives in Memory, the Disk Tells a Lie
A malicious PHP implant tied to F5 BIG-IP APM tampering shows why defenders must check what an appliance serves at runtime, not just what its files look like on disk.
Infostealers Turn AI Coding Assistants Into a Fresh Credential Cache
A familiar malware class is widening its net from browser secrets to local data left behind by AI developer tools, raising the stakes for workstation security.
AI Tools Meet Zero-Click Messaging Risk in a WeChat Worm Demo
A Palo Alto-based security team has put a fast-moving question on the table: when AI helps build exploit code in days, how much warning time do defenders really get?
When a Ring Becomes a Breach: The WeChat Call Path That Could Move Like Malware
A demonstrated zero-click chain on iPhone and Android shows how an incoming call can become an account-takeover path when trust is baked into the wrong part of the app.
Reverse Shells, Not Sliver: The Quiet Windows Foothold Behind a Ransomware Probe
A Windows intrusion tied to a ransomware investigation appears to have relied on reverse shells, credential-theft tooling, service masquerading, and Ethereum-based command control, with one early Sliver readout later corrected.
When a Trusted Registry Turns on Its Users
A redirected module registry can turn ordinary infrastructure automation into a credential risk, especially when Terraform pulls code before anyone notices the path changed.
One Old npm Payload, One Fragile Filter, and a Supply Chain Still on Edge
A known Shai-Hulud npm payload resurfaced after 111 days, putting registry-side malware screening under the microscope and reminding defenders that package installs can be an execution path, not just a download.
Known Malware, New Noise: npm’s Dormant Worm Reappears With a Familiar Fingerprint
A resurfacing malicious npm payload shows how supply-chain threats can return unchanged, turning old indicators into a live operational test for registry defenses and developer hygiene.
When a Remote Support Client Becomes the Delivery Vehicle
Modified ScreenConnect clients are tied to a worm-like campaign that uses backdoored instances to transfer and execute payloads on newly connected clients.
The Malware That Leaves After It Leaves: REVSTEALER’s Hidden Second Act
A Windows stealer that deletes itself may sound like a cleanup success, but the real risk is what remains behind: follow-on code that can suppress defenses and push an infected host into mining duty.
When a Malware Search List Swallows the Developer Stack
A newer Shai-Hulud variant now checks 469 locations for secrets, showing how credential theft is following the sprawl of developer, cloud, and AI tooling.
Trusted Code, Hidden Intent: How Node.js Became a Delivery Path for Targeted Malware
A legitimate JavaScript runtime is being repurposed in targeted intrusions, forcing defenders to look beyond file reputation and toward process behavior.
When a Fake Streaming App Meets Android's Most Dangerous Permissions
A malvertising campaign turned familiar Android features into a control stack for banking fraud, showing how social engineering can be as powerful as code.
A Critical Appliance Flaw Hits the Exploited-Vulnerabilities List as Attackers Chase Shells and Miners
A pre-authentication SSRF in SonicWall SMA 1000 firmware has moved into CISA’s active-exploitation tracker, a sign that edge-device bugs are being turned into live footholds, not just patch notes.
Streaming Lure, Silent Hands: How StreamRAT Turns Android Permissions into Remote Control
A streaming-themed Android campaign shows how a single accessibility grant, paired with VNC-style control, can turn a consumer phone into an operator-driven device.
Fake Download Pages Turn Familiar Brands Into Malware Traps
A counterfeit-software scheme has pushed malicious installers through look-alike download pages, showing how attackers can weaponize trust in common names, official-looking sites, and routine software updates.
When a Blockchain Becomes the Back Office for Malware
A ClickFix-linked campaign shows how attackers can pair user trickery with on-chain infrastructure to rotate command links without relying on a single vulnerable server.
Wallet-Branded Installers Are Becoming Perfect Delivery Vehicles for Browser Theft
A trojanized Exodus wallet installer is being used to drop a modular RAT that focuses on credentials, cookies, and live operator access rather than a quick hit on crypto balances.
Fake Download Pages Became the Door: A Counterfeit Installer Campaign Eyes China’s Workstations
A brand-cloning lure built around familiar software names shows how one mistaken download can turn a routine install into an initial access problem.