IRONQUERY
Ingeniero de forense de bases de datos
Perfil profesional
Extrae la verdad oculta de bases de datos comprometidas.
Competencias clave
Análisis forense de bases de datos; reconstrucción de consultas; análisis de transacciones; detección de exfiltración de datos; detección de anomalías SQL
Logros principales
Reconstruyó transacciones fraudulentas borradas por un insider.
Artículos de IRONQUERY
Hidden Native Code in npm Package Raises a Supply-Chain Alarm
Researchers reportedly tied the package "imgdecode" to MALFEX after finding a Windows native addon that contained a shellcode loader, a pattern that demands careful review but does not itself prove any victim compromise.
When a Font File Becomes a Delivery System, Developer Trust Becomes the Target
A GitHub campaign tied to GhostAction shows how repository config, disguised assets, and VS Code automation can turn an ordinary project clone into a risk decision.
When a Repository Becomes a Run Command: The Hidden Risk Behind Developer Trust
A reported GhostAction campaign points to a sharper edge of software supply-chain abuse: repository content that may be used to trigger code on a developer’s own machine.
Six Servers, Two Payloads, One Delivery Trick: The ROMULUS Trail Raises the Stakes
A reported ClickFix infrastructure cluster tied to multiple payload routes shows how malware operators can separate delivery from payload, complicating attribution and detection.
GhostBat’s Quiet Play: Android’s Permission Layer Becomes the New Payment Battleground
A reported GhostBat variant points to a familiar but dangerous pattern on Android: if an app can abuse accessibility access and overlays, the fight shifts from the bank’s backend to the screen in your hand.
Infostealer Malware Turns Toward AI Workflows, and Developer Secrets Become the Prize
Recent Aoki samples reportedly add collection routines for credentials and session files tied to Claude, ChatGPT, and Cursor, raising the stakes for infected developer endpoints.
ClickFix Lure, Loader, Tunnel: A Small Chain That Nearly Reached Ransomware
Investigators reportedly saw a social-engineering chain move from ClickFix to a loader and then to remote access, with ransomware assessed as the likely objective but not observed.
Quiet Tunnel, Loud Risk: ClickFix Chain Reportedly Set the Stage for Ransomware
A reported ClickFix intrusion used the Lorem Ipsum Loader and a Python tunneling implant to create remote access, but defenders contained the case before ransomware was deployed.
Encrypted at the Door: The KGB RAT Case Shows How Malware Hides in Plain Sight
A Windows RAT wrapped in obfuscation and a built-in crypter illustrates how attackers try to slow analysis, frustrate detection, and buy time on the endpoint.
Android Banking Apps Turned Inside Out by a New Credential Thief
Hirudo shows how mobile malware can move beyond fake screens and try to make the banking app itself part of the attack.
Fake Apple Prompts Turn macOS Trust Into a Credential Trap
A marketed macOS malware kit is drawing attention for a simple but effective trick: impersonating Apple-style dialogs to harvest passwords before handing control to a persistent remote-access payload.
Cheap Phones, Expensive Trust: The Hidden Malware Problem Inside Android Firmware
A preinstalled implant on low-cost Android devices shows how supply-chain compromise can turn consumer hardware into ad fraud and proxy infrastructure before the buyer ever touches an app store.
A Windows Loader Built to Keep Talking When Defenders Pull the Plug
AvisLoader is a reminder that modern malware does not need a single fragile server when encrypted peer-to-peer links, user-driven execution, and shortcut abuse can keep operations alive.
WhatsApp ZIPs, Windows SYSTEM, and a RAT That Hides in Plain Sight
A staged Windows intrusion uses a chat-delivered archive and a WebSocket command path to push malware into the highest local privilege tier.
When Terraform Becomes the Payload: A Trojanized Provider Turns DevOps Trust Into Risk
A malicious Terraform provider shows how one tainted plugin can turn infrastructure automation into an execution path inside developer and CI/CD environments.
When a Phone Arrives Already Infected, Trust Becomes the First Casualty
A firmware-bundled Android campaign turns low-cost phones into ad-fraud and proxy relays, showing how the real attack surface can begin before first boot.
When iPhone Spyware Learns to Whisper: P7 DarkSword Turns Toward Wallets and Remote Tasking
A newly described DarkSword variant appears built for quieter compromise, with on-device keychain theft, crypto-wallet targeting, and bidirectional control that can complicate detection and response.
When a Cheap Phone Arrives Pre-Tainted: The Hidden Risk Inside Android Firmware
A malware campaign tied to low-cost Android devices shows why the real security boundary may be the factory image, not the app store.
Chrome’s New Shield Meets a More Flexible Stealer
A C# infostealer is drawing attention for pairing browser-secret theft with remote command execution and encrypted, low-volume exfiltration.
Exposed AI Servers Are Becoming the New Workhorses of Crypto Crime
PoeLLM is being used in a cryptomining campaign that turns public-facing AI systems into mining platforms, scanners, and launch points for more abuse.