IRONQUERY
Ingeniero de forense de bases de datos
Perfil profesional
Extrae la verdad oculta de bases de datos comprometidas.
Competencias clave
Análisis forense de bases de datos; reconstrucción de consultas; análisis de transacciones; detección de exfiltración de datos; detección de anomalías SQL
Logros principales
Reconstruyó transacciones fraudulentas borradas por un insider.
Artículos de IRONQUERY
Fake CAPTCHA, Real Shell: The ClickFix Lure Turning Windows Into a Tunnel
A reported TerminalFix campaign uses counterfeit Cloudflare-style prompts to push users into running PowerShell, then drops a reverse-tunnel implant that can turn an endpoint into a pivot point.
Ethereum Became the Backup Line for a New Go Malware Framework
A newly identified Go-based payload appears to use smart contracts as a resilient fallback channel, a design that can complicate takedowns and attribution.
SLEEPWALKER Stays Quiet Until the Packet Arrives
A Windows backdoor built around packet-gated activation, DLL side-loading, and in-memory execution shows how some implants are designed to challenge egress-focused defenses rather than overwhelm them.
When the Dashboard Joins the Botnet
Android-based car head units are drawing criminal attention for a simple reason: they are internet-connected computers that can be repurposed for traffic relay, not just entertainment.
AI Helps Malware Move Faster, But Most Samples Still Die Before First Contact
A large malware sample set tied to AI shows a familiar cyber pattern: faster authoring does not automatically translate into better real-world execution.
Fake CAPTCHA, Real Shellcode: How English Words Became a Malware Delivery Trick
A ClearFake-linked chain described by researchers turns trusted websites and human curiosity into a route for WordlistLoader and Amatera Stealer.
When Malware Starts Drafting Its Own Commands
ToxNetV2 is described as a peer-to-peer Linux botnet whose controller feeds telemetry into a large language model to propose shell, SSH, and file-handling actions.
When a Framework Turns Into a Botnet Highway
A reported burst of exploitation against Next.js deployments shows how quickly a web app flaw can be converted into credential theft, proxy abuse, and persistent control.
PavinLoader’s Quiet Trick: How a Trusted Build Tool Becomes a Malware Conveyor Belt
A multi-stage loader linked to fake installers, ClickFix lures, and game-themed packages shows how attackers can hide malicious activity inside ordinary Windows workflows.
Fake Minecraft Downloads Turn Search Results Into a Malware Delivery Lane
WeedHack is still reaching gamers through lookalike sites and suspicious downloads, showing that disrupting command infrastructure does not automatically stop the distribution chain.
SynkLoader Revives an Old Trick With Fresh Criminal Ambition
A multilingual malware family is being linked to screen hijacking and password theft, while a possible ransomware connection remains unconfirmed.
When a Marketplace Relaxes Its Grip, the Malware Trail Gets Harder to Follow
Open VSX’s decision to remove three extension IDs from its malicious-extension list shows how registry trust can change over time and why investigators need more than live reputation checks.
When a Chat Window Becomes the First Door: The SynkLoader Windows Intrusion Pattern
A newly described loader tied to Microsoft Teams phishing shows how conversation-based lures, Windows persistence, and credential theft can chain together into a high-risk intrusion path.
The Trusted Meeting Link That Became a Malware Trap
A compromise of a self-hosted conferencing server can turn a routine client download into an infection path for everyone invited to the meeting.
The Gemini Trap: How a Fake AI Installer Turned a Trusted Name Into a Windows Lure
A malicious file dressed up as Google Gemini shows how brand impersonation and cloud-hosted distribution can push a credential stealer past suspicion.
Android Fraudware With a Mesh Twist: Why Manic Looks Built for Device Takeover
A newly described Android malware family stands out less for one trick than for the way it blends app targeting, PIN theft, lock-screen phishing, and a relay-style exfiltration path into a single fraud workflow.
MacSync’s Trick Is Not the Domain Name - It Is the Pattern It Cannot Shake
Rotating C2 domains may slow blocklists, but stable URI and transfer behavior can still give defenders something durable to hunt.
ToxicPanda 2.0 Raises the Stakes in Android Banking Fraud
A newer build of the Android malware family adds a larger command surface and a PIN-harvesting workflow, showing how mobile fraud keeps shifting toward the device itself.
When a Skill Registry Becomes the Front Door for Stealers
A campaign tied to ClawHavoc turns an AI extension ecosystem into a high-value theft path, with wallets, SSH keys, browser data, and AWS credentials in the crosshairs.
When a CAPTCHA Hides a Loader, the Browser Becomes the Trap
WordlistLoader turns ordinary English words into a camouflage layer for shellcode, tying a text-based disguise to fake verification prompts on compromised websites.