IRONQUERY
Ingeniero de forense de bases de datos
Perfil profesional
Extrae la verdad oculta de bases de datos comprometidas.
Competencias clave
Análisis forense de bases de datos; reconstrucción de consultas; análisis de transacciones; detección de exfiltración de datos; detección de anomalías SQL
Logros principales
Reconstruyó transacciones fraudulentas borradas por un insider.
Artículos de IRONQUERY
Fake AI Tool Downloads Turn Search Results Into a Developer Trap
A lure built around Gemini CLI and Claude Code shows how SEO poisoning can funnel developers toward a fileless PowerShell infostealer.
A Quiet Dependency Turned Into a Credential Trap
A compromise in several Laravel-Lang PHP packages shows how a low-profile update path can become a high-trust delivery channel for credential theft.
Old Router Flaws, Fresh Botnet Power: Why a 2018 ASUS Bug Still Matters
A long-known authentication flaw in ASUS routers has reappeared as a useful tool for RondoDox, showing how stale edge-device bugs can still fuel modern botnet campaigns.
When a Windows Shortcut Becomes a Scanner Trap
A junction-based traversal trick shows how ordinary NTFS features can turn recursive endpoint inspection into a reliability problem.
Arrest in a Botnet Case Exposes the Business Logic Behind DDoS Crime
A Canadian arrest tied to the Kimwolf matter highlights how botnets turn weakly protected devices into rented traffic weapons, and why the legal fight is now as important as the malware itself.
Botnet for Sale, Suspect in Custody: The KimWolf Case Exposes the Machinery Behind DDoS Abuse
Authorities’ arrest in connection with KimWolf puts the spotlight on the control layer, not just the malware: how compromised devices are organized, rented, and used to flood targets at scale.
Shortcut Lures, Trusted Tools: Inside a Campaign Built to Blend In
A phishing operation tied to malicious Windows shortcuts shows how attackers can hide in plain sight by abusing familiar file types and legitimate software ecosystems.
MSHTA Still Opens a Quiet Door for Windows Intruders
A legacy Microsoft utility can still be turned into a stealthy execution path, showing that retiring Internet Explorer does not retire every browser-era risk.
Trapdoor’s Mobile Fraud Machine: When Android Apps Become Ad-Tech Weapons
A large Android campaign appears to have turned app installs, hidden web content, and remote commands into a scalable fraud pipeline that strained the line between mobile software and criminal infrastructure.
Hidden in Plain Sight: How BadIIS Turns IIS Servers Into Traffic-Control Nodes
A malicious IIS component can sit inside a web server’s request path, redirecting selected traffic while leaving the site looking normal to most visitors.
Gremlin Stealer Hides Its Tracks in Encrypted .NET Resources and Runtime Bytecode
The latest Gremlin Stealer variant appears built for delay and concealment, combining encrypted resource storage with a commercial packer that turns ordinary code into custom bytecode.
Poisoned Workflow Code: The DurableTask Package That Put Trust on Trial
Three PyPI releases tied to Microsoft’s DurableTask Python client were marked malicious and quarantined, turning a routine dependency into a supply-chain warning for automation-heavy teams.
When Malware Moves Into the Blockchain, Takedown Gets Harder
Void Botnet is reportedly using Ethereum smart contracts as part of a resilient C2 layer, a design that shifts the defensive fight from servers and domains to public chain data.
A One-Letter Slip Turns a Trusted Go Dependency Into a Supply-Chain Trap
A lookalike module path can become more than a typo when malicious code sits behind it, and DNS can provide a quiet channel for control.
When Package Trust Becomes the Attack Surface
A sprawling npm supply-chain incident shows how a single publishing path can ripple through developer tooling, while provenance metadata may look reassuring even when it is part of the problem.
Windows’ Own Tools Return as the Quiet Path into Military Networks
A reported UAC-0184 campaign pairs BITS staging with HTA execution and signed binaries, showing how ordinary Windows components can be chained into a stealthy delivery route.
MSHTA Returns as a Quiet Delivery Route for Malware
Attackers are increasingly using Microsoft’s legacy Windows HTML Application host to move stealers, loaders, and persistent malware through phishing and fake download lures.
A Popular Developer Extension, a Quiet Update, and a Credential-Theft Risk
A compromised Nx Console package landing in the VS Code marketplace shows how a trusted extension update can become a high-value supply-chain risk for developers.
The Trust Chain Is Burning: What a Week of Mixed Attacks Reveals
A roundup of an Exchange 0-day, an npm worm, a fake AI page, and a Cisco exploit points to one recurring tactic: attackers keep going after systems people already trust.
Invoice Lures and Archive Traps: The Delivery Chain Behind PureLogs
A phishing email, a TXZ attachment, and a JavaScript file form the observed path to a loader linked with the PureLogs infostealer.