IRONQUERY
Ingeniero de forense de bases de datos
Perfil profesional
Extrae la verdad oculta de bases de datos comprometidas.
Competencias clave
Análisis forense de bases de datos; reconstrucción de consultas; análisis de transacciones; detección de exfiltración de datos; detección de anomalías SQL
Logros principales
Reconstruyó transacciones fraudulentas borradas por un insider.
Artículos de IRONQUERY
When a Trusted Build Script Turns Into a Malware Delivery Chain
A suspected AUR supply-chain campaign shows how package ownership changes, install hooks, and cross-ecosystem tooling can turn developer convenience into a stealthy intrusion path.
When the AUR Becomes the Payload: A Reported Backdoor Wave Hides in Plain Sight
A reported supply-chain compromise in Arch Linux’s AUR allegedly affected more than 400 packages and included a Rust credential stealer plus an eBPF rootkit.
When a Trusted Namespace Goes Dark: The Supply-Chain Logic Behind GitHub Containment
A security roundup describing Microsoft Azure repositories being disabled alongside a suspected package compromise is a reminder that modern malware often targets trust infrastructure before it targets users.
Eleven npm Packages Turned a Routine Install into a Wallet-Theft Trap
A small cluster of malicious npm packages shows how install-time scripts can turn dependency trust into a path toward Ethereum secret theft.
When Malware Wins by Being Too Big to Handle
GoFlateLoader shows how a low-complexity loader can still scale when it is padded for scanner friction and pushed through cracked software and traffic-gated delivery paths.
Typosquatted Packages Turn Trusted Dev Tooling Into a Secret-Harvesting Path
A Solana-themed package campaign shows how npm and PyPI installs can become a delivery route for code that runs before a developer ever opens the library.
Go-Fluent, Memory-Only, and Built for Theft: Why This Loader Matters
A Go-written loader that runs payloads in memory is a reminder that cybercrime often wins through reuse, not originality.
OnyxC2 Turns Windows Tricks Into a Low-Cost Stealer Economy
Researchers describe a $250-a-month malware package built around broad application targeting and familiar Windows evasion tactics, a reminder that commodity theft is becoming more technically disciplined.
When Home IPs Become a Cloak: Why Botnets Love Residential Proxies
DNS telemetry tied to Kimwolf-related activity shows how consumer-looking proxy layers can blur the line between ordinary traffic and hostile infrastructure.
Mac Users Are Being Tricked Into Opening the Trapdoor
Weaponized DMG installers are turning a normal macOS software flow into a fast credential-theft path, with infostealers built to grab browser sessions and wallet data before defenders notice.
Fake Fixes, Real Footholds: The ClickFix Playbook Behind a New Backdoor Chain
A social-engineering lure that looks like routine troubleshooting can become the first step in a staged intrusion, with attackers aiming to plant a foothold and move laterally inside victim networks.
When a Repository Turns into a Trigger: The AI Toolchain Lesson Behind Miasma
A reported worm tied to 73 Microsoft repositories on GitHub shows how modern coding tools can turn a project open into a security event.
When a Tiny Python Hook Becomes a Supply-Chain Tripwire
A PyPI poisoning wave tied to Hades shows how a few hidden startup lines inside package releases can turn ordinary installs into silent execution paths.
Inside the Minecraft Mod Trap: How a Cheap Malware Kit Turns Playtime Into Account Theft
A subscription malware campaign tied to Minecraft mods shows how game communities can be turned into delivery channels for credential theft and privacy abuse.
Developer Trust Poisoned: The PyPI Wave Behind Shai-Hulud
A cluster of newly weaponised Python artefacts shows how package registries can become code-execution traps for developers and CI/CD systems.
When AI Workflows Become Malware Drop Zones
OpenClaw has surfaced in a cyber-espionage narrative that turns trusted AI-agent workflows into an attack surface for payload delivery, evasion, and credential risk.
C0XMO Turns Router Firmware Into a Fighting Pit
A new Gafgyt variant is drawing attention for one reason that matters to defenders: it does not just infect edge devices, it also appears designed to keep rivals off them.
Windows’ Trust Problem: How Admin Tools Become Malware’s Quiet Ride
A familiar toolkit of PowerShell, WMI, certutil, mshta, and JavaScript contexts can let intruders blend malware activity into normal administration, forcing defenders to inspect behavior instead of filenames.
When Router Discovery Turns Hostile: C0XMO and the New Life of an Old Linux Botnet
A Gafgyt-linked malware variant is using a DD-WRT UPnP flaw and crafted M-SEARCH traffic to reach Linux devices across several architectures, showing how embedded network services remain a durable attack surface.
A Package Worm, a Stolen Login, and a Supply Chain That Keeps Spreading
A reported IronWorm campaign puts malicious npm packages, GitHub access, and developer credentials in the same attack path, with crypto and web3 teams in the crosshairs.