IRONQUERY
Ingeniero de forense de bases de datos
Perfil profesional
Extrae la verdad oculta de bases de datos comprometidas.
Competencias clave
Análisis forense de bases de datos; reconstrucción de consultas; análisis de transacciones; detección de exfiltración de datos; detección de anomalías SQL
Logros principales
Reconstruyó transacciones fraudulentas borradas por un insider.
Artículos de IRONQUERY
ClingSTUN Shows How Linux Malware Can Hide in Legitimate Network Noise
A reported Linux backdoor blends proxying, persistence, and self-propagation logic with STUN traffic, creating a detection problem that is more behavioral than signature-based.
When a Theme Turns Toxic: The VS Code Supply-Chain Angle Behind GlassWorm
A seemingly cosmetic editor add-on can become a delivery vehicle when extension packages carry executable code, not just colors.
The Browser Cache Trap: ClickFix Turns a Familiar Web Feature Into a Hiding Place
A Microsoft threat team analysis points to a ClickFix campaign that stashes malicious content in browser cache and dresses it up as a PNG, a reminder that ordinary web plumbing can become attacker cover.
The WordPress Backdoor That Would Not Stay Dead
A malware cluster codenamed SC appears to have survived cleanup by scattering its presence across files, database state, and shared memory, turning removal into a sequencing problem.
Inside SC: The WordPress Malware That Rebuilds Its Own Footholds
A newly studied WordPress malware family uses multiple persistence points across database and runtime layers, so removing one backdoor can still leave the rest ready to repopulate it within seconds.
DarkSword Raises a Harder Question Than Another Malware Alert
A named iPhone exploit kit, an Android mention, and a sensitive attribution claim point to a deeper problem: mobile targeting is increasingly about delivery paths, not just malicious apps.
When a Trusted GPT Becomes the Bait: ClickFix Turns AI Credibility into Malware Delivery
A reported campaign shows attackers using ChatGPT Custom GPTs as a trust layer, then handing victims off to ClickFix-style lure pages that can lead to remote access malware.
How a Supply-Chain Probe Surfaced a Hidden Malware Framework
NeedyMantis was not confirmed as a supply-chain payload itself, but investigators tracing DAEMON Tools indicators uncovered a modular post-compromise framework built for targeted intrusions.
When the Malware Site Stares Back: SilverFox’s New Trick
A reported SilverFox-linked campaign uses fake software pages that behave differently for researchers and potential victims, turning simple inspection into a moving target.
Fake Software, Real Risk: The Windows Installer Trap That Hides in Plain Sight
A branded download page can look harmless, but counterfeit installers remain one of the cleanest ways to turn routine software hunting into a compromise path.
BotHelper RAT Turns a Windows Screen Into a Remote Window for Spies
A newly documented Windows RAT combines stealth, persistence, and live desktop streaming, showing how a single host can become an operator’s interactive control panel.
Klez Turned Inboxes Into Launchpads and Windows Paid the Price
The 2001 Klez worm shows how a mass-mailing threat can fuse spoofed identity, unsafe email rendering, and file-share spread into one fast-moving infection engine.
When a Laptop Becomes a Login: The Quiet Power of Infostealer Malware
A single infected developer device can spill passwords, API keys, and login tokens into the hands of criminals, turning endpoint theft into cloud and AI access.
Open Docker Registries, Closed Doors: Why a Botnet Wanted AI Keys First
An exposed container registry can become more than a repository problem - it can turn into a secret warehouse that malware can mine for reusable credentials.
PamStealer Pushes macOS Malware Toward Live, Server-Dependent Decryption
A newer PamStealer build appears to make its core payload harder to recover offline, while still leaning on macOS-native scripting and persistence paths that defenders know too well.
MacSync’s Shift to Native Code Raises the Bar for macOS Defenders
A newer MacSync variant reportedly moves beyond AppleScript-heavy delivery, using compiled macOS binaries to deliver an infostealer and a backdoor in a more layered infection chain.
Docker’s Quiet Weak Spot Becomes a Botnet Gateway
Carbonato turns exposed container management into an entry point, then reportedly drops the Hermes Agent framework onto systems that should never have been reachable.
When a Desktop Script Becomes a Backdoor: the Quiet Machinery Behind TASK#STOMP
A Windows Script Host file, a PowerShell backdoor, and a two-server exfiltration setup show how ordinary admin tools can be bent into a durable document-theft pipeline.
Copy, Paste, and Connect: The Windows Loader Turning a Fake Check Into a Hidden Channel
AvisLoader pairs a ClickFix-style lure with Tox-based peer-to-peer command control, a combination that can push defenders beyond simple domain blocking.
Windows Malware Tries a New Trick: Letting AI Models Pick the Next Move
A sample named CLOSEDQUORUM has been described as malware that routes part of its decision-making through up to four AI models, while still aiming at familiar Windows secrets.