IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Shadow hVNC Turns a Windows Screen Into a Blind Spot
A hidden-desktop malware trick gives operators a second, invisible workspace on Windows, changing the fight from screen watching to session hunting.
Mirai’s Old Ghost Returns as a Silent Proxy Factory
Evooo1Bot appears to be more than another DDoS botnet: it turns internet-facing Linux devices into SOCKS5 relays, a shift that makes compromised edge hardware useful for concealment as well as disruption.
When a Backdoor Learns to Hide in the Kernel
A Windows implant reportedly gained a kernel-mode rootkit layer, a move that can make malware and command traffic harder to see from inside the host itself.
When an Image File Starts Acting Like an Unpacker, Browsers Become the New Malware Layer
A DCRat campaign shows how a seemingly ordinary SVG attachment can push part of the attack chain into the browser, where file type alone is no longer a reliable safety signal.
When an IoT Botnet Becomes a Shadow Network
Roughly 296,000 internet-connected devices were identified in a campaign tied to Dysphoria, a botnet associated with DDoS traffic and residential proxy abuse.
When a Mac Stealer Wants Your Session, Not Your Password
AmnesiaStealer is a Rust-built macOS infostealer that targets stored credentials and browser state, a combination that can turn stolen data into reusable access.
Mirai Learns to Whisper: A Botnet Variant Hides in Plain Sight
A new Mirai variant combines encrypted command traffic with a built-in search for default access credentials, reinforcing how old IoT abuse paths keep paying off for botnet operators.
10 CNI Networks Flagged With Infostealer Exposure as Manufacturing Makes Up the Largest Share
A new UK-focused threat snapshot points to identity theft, not noisy disruption, as the quieter risk facing essential services.
When a Botnet Starts Dressing Like Chrome, DDoS Defense Gets Harder
A reported Kimwolf variant pairs HTTP/2 flooding with browser-like fingerprints, pushing defenders to look beyond simple client labels and toward protocol behavior.
How a Counterfeit CCleaner Installer Can Turn a Browser Into the Payload
A trusted maintenance brand, a fake Windows installer, and a reported Chrome extension named GhostDesk show how attackers can move from desktop trust to browser risk in one chain.
When a Phone Call Becomes a Payment Relay: The WindRelay and SpyNote Fraud Chain
A reported Android malware operation pairs remote handset control with live NFC relaying, turning a victim phone into part of the fraud path rather than just a compromised endpoint.
Trusted, Then Poisoned: How a LiteLLM Package Incident Exposed the Fragility of Software Supply Chains
A reported compromise tied to Trivy and LiteLLM shows how a single trust break in the build chain can ripple outward into malware distribution and broad organizational risk.
One Prompt, One Loader, One Door Left Open
A ClickFix-style lure can hand control to a modular loader chain and end with a persistent remote shell, turning user trust into operator access.
Abyssos Puts Windows Control on Two Tracks: Shell Commands and Full Desktop Access
A newly tracked C++ RAT is drawing attention because it combines remote shell access, VNC-style desktop control, and file-system control in a modular Windows malware family.
A Quiet Browser Takeover Turns Malware into a Shadow Operator
Abyssos combines session theft, credential harvesting, file exfiltration, and hidden remote control in a way that shifts the danger from simple theft to live intrusions.
GitHub Turns Malicious Package Reports Into a Wider Tripwire for Open Source
Dependabot is moving beyond npm-only malware alerts, using GitHub Advisory Database ingestion to flag malicious dependencies across eight package ecosystems.
GitHub Turns Malware Feeds Into a Wider Supply-Chain Tripwire
Dependabot’s malware alerts have moved beyond npm, extending the same remove-or-replace warning model across major package ecosystems and sharpening the focus on malicious dependencies.
Fake Zoom Installer Turns a Trusted Mac Workflow Into a Malware Gate
A brand-masquerade installer, a native macOS binary, and a .NET stage show how ordinary software trust can be turned into a delivery path for remote-control malware.
The Registry Trap Hiding Inside AI Coding Help
A fast-moving npm campaign linked to WEL1DROPPER shows how package names themselves can become the attack surface when developers trust AI-suggested dependencies.
Fake Zoom Installers, Real Cross-Platform Risk: The Loader Trick Security Teams Keep Missing
A malware campaign tied to a Zoom-branded installer shows how a familiar software path can be repurposed to move the same threat across macOS and Windows.