IRONQUERY
Ingeniero de forense de bases de datos
Perfil profesional
Extrae la verdad oculta de bases de datos comprometidas.
Competencias clave
Análisis forense de bases de datos; reconstrucción de consultas; análisis de transacciones; detección de exfiltración de datos; detección de anomalías SQL
Logros principales
Reconstruyó transacciones fraudulentas borradas por un insider.
Artículos de IRONQUERY
Telegram-Controlled Tooling Blends WiFi Credential Hunts With Network Flooding
A reported Python framework ties together wireless credential extraction, disruption, proxy use, and DDoS-style traffic, showing how a single script can mix access, control, and impact.
Inside the Shadow Market for Windows Evasion: A Crypter Built to Disappear
A reported Mono-based crypter marketed on underground forums is said to combine BYOVD and process ghosting, a pairing that can make RAT and infostealer delivery harder to spot and slower to investigate.
When a Calendar Becomes a Control Plane: HollowGraph and the Quiet Abuse of Microsoft 365
A malware component reported to use a compromised Microsoft 365 calendar as a two-way dead-drop shows how trusted collaboration tools can be turned into covert command channels.
Telegram as a Quiet Control Room: The Malware Chain That Hid Behind Normal Messaging
A newly described intrusion set used Telegram bots for command and control, then layered in obfuscation and environment-bound payloads to make analysis and detection harder.
When a Build Workflow Turns Hostile: The AsyncAPI npm Incident
A malicious release surfaced in a trusted package path, showing how compromised automation can turn software delivery into a malware channel.
Inside the AI Trapdoor: Malicious Skills, Fake Registries, and the New Malware Supply Chain
A reported campaign abused AI tool listings, GitHub-style trust cues, and MCP workflows to move SmartLoader first and StealC second, turning documentation into part of the attack path.
When a Calendar Becomes a Spy Channel: HOLLOWGRAPH and the New Abuse of Microsoft 365
A Windows malware implant is reported to hide its command traffic inside Microsoft 365 calendar activity, showing how trusted collaboration tools can be turned into covert control infrastructure.
Inside Furtex: A Linux Toolkit Built to Stay Close to the Kernel
MatheuZSecurity’s newly announced Furtex package puts raw io_uring and eBPF in the spotlight, showing how post-exploitation tooling can lean on legitimate Linux primitives to pursue stealthier process manipulation and data theft.
Ruby’s Quiet Trust Chain Becomes a Loud Risk
A malicious package cluster in the Ruby ecosystem shows how ordinary gem installs can become a staging point for payload delivery on developer machines.
Two Trust Boundaries, One Trap: Active Images and Package Registries Turned Against Developers
A malware campaign linked to SVG files and a separate RubyGems supply-chain incident show how developers can be targeted through the tools they use most.
Inside the Job-Test Trap: How SVG Files Became a Malware Delivery Layer
A developer hiring exercise can look routine on the surface, yet the technical path underneath may hide staged malware, credential theft, and file harvesting.
Fake Installers, Real Access: The Two-Stage Malware Play Behind UAT-11795
A trojanized software installer can be more than a nuisance - in this campaign it is the handoff point for a remote access trojan and a separate in-memory backdoor built to keep control alive.
When a Font Attachment Becomes a Delivery Vehicle for Malware
A fake .ttf file can look harmless to a user and still serve as the first step in a multi-stage intrusion chain built around Lua loaders and commodity malware.
When a Paste Becomes a Breach: The Stealer Playbook Behind ClickFix
A user-driven lure can turn a single Windows command into credential theft, session replay, and local document harvesting from synced cloud workspaces.
The AI Control Plane Just Became Botnet Terrain
A Go-written malware operation reported to use 20+ RCE vectors shows how quickly AI connectors and MCP-style services can become a practical target for automation.
When a Windows Utility Becomes the Loader: The ACR Stealer Playbook
A credential thief spotted in mid-2026 used a trusted Microsoft binary and image-based concealment to reach for browser secrets, tokens, and documents.
Mac Users Tricked at the Trust Gate: ClickLock Stealer Turns Verification Into an Attack Path
A newly identified macOS stealer appears to rely on fake verification prompts and user-driven command execution rather than exploits or privilege escalation.
When a Fake macOS Prompt Starts Fighting Back, the Password Is the Prize
ClickLock Stealer shows how a pasted Terminal command, a forged login prompt, and a rapid app-kill loop can turn ordinary Mac workflows into pressure tactics.
Fake Meeting Apps, Real Malware: How a Trusted Download Became a Trap
A campaign tied to trojanized collaboration software shows how attackers can turn ordinary installer habits into a credential-theft and wallet-theft pipeline.
macOS Infostealer Turns Trusted Sessions Into a Quiet Entry Point
A reported macOS infostealer shows how stolen sessions, browser secrets, and fake wallet launch paths can move a single endpoint problem into account and crypto risk.