IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Fake Installers, Real Risk: How Brand Clones Turn Windows Downloads Into Entry Points
A malware campaign using counterfeit pages for Microsoft Edge, Kaspersky, and Razer shows how ordinary software-seeking behavior can become an initial-access trap on Windows.
When a Botnet’s Own Mesh Becomes the Trap
A multinational disruption of Sality shows how peer-to-peer malware can be weakened when defenders understand the protocol well enough to interfere with its trust layer.
Sality’s Long Game Interrupted: How Defenders Hit a P2P Botnet Where It Communicates
A 23-year-old malware network was disrupted by targeting the way it finds peers and the web locations it uses to pull payloads.
When the Kernel Goes Quiet: A Rootkit Tactic That Can Starve Linux Defenders of Telemetry
A disclosed bypass tied to the Singularity Linux rootkit shows how module-load visibility, not just files or processes, can become the first thing attackers try to silence.
When a Linux Rootkit Turns the Sensor Against Itself
A research demo against Elastic Defend highlights a harder problem for Linux security: if the kernel telemetry path can be tampered with, the alert may never fire.
The Backdoor That Sleeps in a Trusted Agent Until the Right Packet Knocks
SLEEPWALKER shows how Windows DLL side-loading and trigger-based activation can turn a normal management process into a stealthy hiding place.
SLEEPWALKER Turns the Usual Malware Playbook Inside Out
This Windows backdoor does not appear to live on noisy beaconing alone - it can wait for a trigger, then move tasking through DNS, VMware VMCI, named pipes, and memory-only execution paths.
When Trust Becomes the Payload: ValleyRAT’s Quiet Infiltration of a Signed Utility
A Windows backdoor linked to Silver Fox was disguised inside a signed wallpaper app, turning software trust and antivirus exclusions into part of the intrusion path.
Fake CAPTCHA, Real Foothold: How TerminalFix Turns a Simple Paste Into Internal Reach
A ClickFix-style campaign uses brand impersonation, PowerShell, DLL sideloading, and hidden payloads to push compromised Windows hosts toward proxy-like access inside a network.
GitHub, Scripts, and a Trusted Windows Utility Form a Quiet Malware Conveyor Belt
A reported loader chain tied to Blind Eagle combines public code hosting, VBScript, PowerShell, and InstallUtil to place AsyncRAT on Windows systems.
Gryxa’s Quiet Trick: A Toolkit That Keeps Reading the Cleanup
The intrusion set is reported to use legitimate RMM software, steal browser credentials, and leave behind a surviving component that can collect Windows logs and host artifacts after visible removal.
Gryxa and the New Logic of Cleanup Resistance
A Windows toolkit tied to financially motivated activity shows how abuse of legitimate remote access, browser credential theft, and layered persistence can turn incident response into a moving target.
The Operator Got Burned: How One Infostealer Opened a Window Into a Malware Workshop
A compromised attacker-side workstation offered a rare look at the moving parts behind a suspected Blind Eagle-related operation, showing how phishing, loaders, and scripting tools can sit behind a single campaign.
Fake CAPTCHA, Real Shell: The ClickFix Lure Turning Windows Into a Tunnel
A reported TerminalFix campaign uses counterfeit Cloudflare-style prompts to push users into running PowerShell, then drops a reverse-tunnel implant that can turn an endpoint into a pivot point.
Ethereum Became the Backup Line for a New Go Malware Framework
A newly identified Go-based payload appears to use smart contracts as a resilient fallback channel, a design that can complicate takedowns and attribution.
SLEEPWALKER Stays Quiet Until the Packet Arrives
A Windows backdoor built around packet-gated activation, DLL side-loading, and in-memory execution shows how some implants are designed to challenge egress-focused defenses rather than overwhelm them.
When the Dashboard Joins the Botnet
Android-based car head units are drawing criminal attention for a simple reason: they are internet-connected computers that can be repurposed for traffic relay, not just entertainment.
AI Helps Malware Move Faster, But Most Samples Still Die Before First Contact
A large malware sample set tied to AI shows a familiar cyber pattern: faster authoring does not automatically translate into better real-world execution.
Fake CAPTCHA, Real Shellcode: How English Words Became a Malware Delivery Trick
A ClearFake-linked chain described by researchers turns trusted websites and human curiosity into a route for WordlistLoader and Amatera Stealer.
When Malware Starts Drafting Its Own Commands
ToxNetV2 is described as a peer-to-peer Linux botnet whose controller feeds telemetry into a large language model to propose shell, SSH, and file-handling actions.