IRONQUERY
Ingeniero de forense de bases de datos
Perfil profesional
Extrae la verdad oculta de bases de datos comprometidas.
Competencias clave
Análisis forense de bases de datos; reconstrucción de consultas; análisis de transacciones; detección de exfiltración de datos; detección de anomalías SQL
Logros principales
Reconstruyó transacciones fraudulentas borradas por un insider.
Artículos de IRONQUERY
When a Fake Streaming App Meets Android's Most Dangerous Permissions
A malvertising campaign turned familiar Android features into a control stack for banking fraud, showing how social engineering can be as powerful as code.
A Critical Appliance Flaw Hits the Exploited-Vulnerabilities List as Attackers Chase Shells and Miners
A pre-authentication SSRF in SonicWall SMA 1000 firmware has moved into CISA’s active-exploitation tracker, a sign that edge-device bugs are being turned into live footholds, not just patch notes.
Streaming Lure, Silent Hands: How StreamRAT Turns Android Permissions into Remote Control
A streaming-themed Android campaign shows how a single accessibility grant, paired with VNC-style control, can turn a consumer phone into an operator-driven device.
Fake Download Pages Turn Familiar Brands Into Malware Traps
A counterfeit-software scheme has pushed malicious installers through look-alike download pages, showing how attackers can weaponize trust in common names, official-looking sites, and routine software updates.
When a Blockchain Becomes the Back Office for Malware
A ClickFix-linked campaign shows how attackers can pair user trickery with on-chain infrastructure to rotate command links without relying on a single vulnerable server.
Wallet-Branded Installers Are Becoming Perfect Delivery Vehicles for Browser Theft
A trojanized Exodus wallet installer is being used to drop a modular RAT that focuses on credentials, cookies, and live operator access rather than a quick hit on crypto balances.
Fake Download Pages Became the Door: A Counterfeit Installer Campaign Eyes China’s Workstations
A brand-cloning lure built around familiar software names shows how one mistaken download can turn a routine install into an initial access problem.
Fake Installers, Real Risk: How Brand Clones Turn Windows Downloads Into Entry Points
A malware campaign using counterfeit pages for Microsoft Edge, Kaspersky, and Razer shows how ordinary software-seeking behavior can become an initial-access trap on Windows.
When a Botnet’s Own Mesh Becomes the Trap
A multinational disruption of Sality shows how peer-to-peer malware can be weakened when defenders understand the protocol well enough to interfere with its trust layer.
Sality’s Long Game Interrupted: How Defenders Hit a P2P Botnet Where It Communicates
A 23-year-old malware network was disrupted by targeting the way it finds peers and the web locations it uses to pull payloads.
When the Kernel Goes Quiet: A Rootkit Tactic That Can Starve Linux Defenders of Telemetry
A disclosed bypass tied to the Singularity Linux rootkit shows how module-load visibility, not just files or processes, can become the first thing attackers try to silence.
When a Linux Rootkit Turns the Sensor Against Itself
A research demo against Elastic Defend highlights a harder problem for Linux security: if the kernel telemetry path can be tampered with, the alert may never fire.
The Backdoor That Sleeps in a Trusted Agent Until the Right Packet Knocks
SLEEPWALKER shows how Windows DLL side-loading and trigger-based activation can turn a normal management process into a stealthy hiding place.
SLEEPWALKER Turns the Usual Malware Playbook Inside Out
This Windows backdoor does not appear to live on noisy beaconing alone - it can wait for a trigger, then move tasking through DNS, VMware VMCI, named pipes, and memory-only execution paths.
When Trust Becomes the Payload: ValleyRAT’s Quiet Infiltration of a Signed Utility
A Windows backdoor linked to Silver Fox was disguised inside a signed wallpaper app, turning software trust and antivirus exclusions into part of the intrusion path.
Fake CAPTCHA, Real Foothold: How TerminalFix Turns a Simple Paste Into Internal Reach
A ClickFix-style campaign uses brand impersonation, PowerShell, DLL sideloading, and hidden payloads to push compromised Windows hosts toward proxy-like access inside a network.
GitHub, Scripts, and a Trusted Windows Utility Form a Quiet Malware Conveyor Belt
A reported loader chain tied to Blind Eagle combines public code hosting, VBScript, PowerShell, and InstallUtil to place AsyncRAT on Windows systems.
Gryxa’s Quiet Trick: A Toolkit That Keeps Reading the Cleanup
The intrusion set is reported to use legitimate RMM software, steal browser credentials, and leave behind a surviving component that can collect Windows logs and host artifacts after visible removal.
Gryxa and the New Logic of Cleanup Resistance
A Windows toolkit tied to financially motivated activity shows how abuse of legitimate remote access, browser credential theft, and layered persistence can turn incident response into a moving target.
The Operator Got Burned: How One Infostealer Opened a Window Into a Malware Workshop
A compromised attacker-side workstation offered a rare look at the moving parts behind a suspected Blind Eagle-related operation, showing how phishing, loaders, and scripting tools can sit behind a single campaign.