IRONQUERY
Ingénieur forensique de bases de données
Profil professionnel
Extrait la vérité cachée des bases de données compromises.
Compétences clés
Forensique des bases de données; reconstruction de requêtes; analyse des transactions; détection d’exfiltration de données; détection d’anomalies SQL
Réalisations majeures
Reconstruction de transactions frauduleuses supprimées par un initié.
Articles de IRONQUERY
npm’s Trusted Path, Weaponized: MALFEX Shows How a Package Install Can Become Malware Delivery
A long-running campaign in the npm ecosystem has been linked to malicious packages that delivered RATs and stealers, turning routine dependency installs into a supply-chain risk.
npm’s Trust Layer Becomes a Delivery Route for Windows Malware
A persistent package campaign shows how a familiar developer registry can be used to plant loaders, stealers, and remote-control tools aimed at everyday credentials and crypto secrets.
When a Trusted SDK Turns Toxic: The Tensorlake npm Compromise and the Hidden Risk in AI Toolchains
A tainted Tensorlake package in npm is a reminder that software supply chains can turn into credential traps long before defenders notice the first suspicious request.
When Phishing Hides Its Trail in Public Blockchains
A malware campaign pairs email lures with Ethereum and TON to refresh command-and-control locations without relying on a fixed server address.
Blockchain as a Hideout: Malware Is Chasing the Secrets Behind the Build
A reported campaign pairing ChainDrop and PolinRider shows how cloud and CI/CD identities can become the real target when malware uses blockchain-based command channels.
Poisoned npm Release Turns a Developer SDK Into a Secret-Harvesting Risk
A compromised Tensorlake package version has been linked to a Shai-Hulud worm variant, sharpening the warning around how fast supply-chain malware can turn cloud and SSH secrets into liabilities.
Guest Complaints Become Malware Traps in a Hotel Phishing Campaign
Accommodation staff are being baited with fake reviews and complaint emails that deliver malware families designed to hide their command-and-control location behind public blockchains.
When the Loader Learns to Hide: MATCHBOIL’s Shift From Dropper to Stealth Tool
A C# downloader tied to UAC-0099 shows how a first-stage implant can be hardened with sandbox checks, obfuscation, and fake windows before the backdoor ever appears.
The Browser Became the Prize: A Malicious Extension Turns Tabs into a Control Surface
A Windows infostealer campaign is abusing Chromium extensions to steal browser data and manipulate what victims see in real time.
Healthcare Intrusion Kept Alive by Telegram and DNS Tricks
A long-running campaign tied to Partisan Zmiy shows how simple transport choices and scheduled execution can keep access alive long after an intrusion should have been found.
Earth Sirrush’s Long Game: A Spy Campaign That Changes Malware, Not Its Habits
Analysts say a Russia-aligned intrusion set has kept pressure on Ukrainian public-sector and defense targets by rotating malware while preserving the same operational patterns.
The ATM Malware Arrest That Exposes a Hidden Cash Pipeline
The reported FBI arrest tied to Ploutus is less about one fugitive and more about how ATM jackpotting blends local access, malware, and organized-crime finance.
npm’s Hidden Trap: A Long-Running MALFEX Campaign Turned Ordinary Installs Into Exposure Events
A supply-chain malware run tied to MALFEX has been active since August 2023, showing how package installs can become security events long before defenders notice.
When a Botnet Dresses Like STUN: Cling’s Quiet War on IoT Defenses
Cling turns a familiar NAT-traversal protocol into cover for command traffic, showing how old embedded-device flaws and ordinary network noise can be fused into one stealth layer.
Cling Botnet Hides Its Orders Inside a Traffic Pattern Defenders Trust
A botnet tied to exposed IoT and networking gear shows how attackers can blend command traffic into a common NAT-traversal protocol and make routine telemetry look harmless.
ClingSTUN Turns Forgotten Linux Boxes Into Silent Proxy Outposts
The malware chain is built for endurance: persistence at boot, concealment in the filesystem, and STUN-based connectivity that helps compromised devices stay reachable through NAT.
Hidden in Plain UDP: Cling Botnet Tries to Ride a Patched Realtek Flaw
Observed exploit attempts against Realtek Jungle SDK components show how edge-device malware can borrow legitimate network behavior to make command traffic look routine.
ClingSTUN Shows How Linux Malware Can Hide in Legitimate Network Noise
A reported Linux backdoor blends proxying, persistence, and self-propagation logic with STUN traffic, creating a detection problem that is more behavioral than signature-based.
When a Theme Turns Toxic: The VS Code Supply-Chain Angle Behind GlassWorm
A seemingly cosmetic editor add-on can become a delivery vehicle when extension packages carry executable code, not just colors.
The Browser Cache Trap: ClickFix Turns a Familiar Web Feature Into a Hiding Place
A Microsoft threat team analysis points to a ClickFix campaign that stashes malicious content in browser cache and dresses it up as a PNG, a reminder that ordinary web plumbing can become attacker cover.