IRONQUERY
Ingénieur forensique de bases de données
Profil professionnel
Extrait la vérité cachée des bases de données compromises.
Compétences clés
Forensique des bases de données; reconstruction de requêtes; analyse des transactions; détection d’exfiltration de données; détection d’anomalies SQL
Réalisations majeures
Reconstruction de transactions frauduleuses supprimées par un initié.
Articles de IRONQUERY
The Browser Became the Prize: A Malicious Extension Turns Tabs into a Control Surface
A Windows infostealer campaign is abusing Chromium extensions to steal browser data and manipulate what victims see in real time.
Healthcare Intrusion Kept Alive by Telegram and DNS Tricks
A long-running campaign tied to Partisan Zmiy shows how simple transport choices and scheduled execution can keep access alive long after an intrusion should have been found.
Earth Sirrush’s Long Game: A Spy Campaign That Changes Malware, Not Its Habits
Analysts say a Russia-aligned intrusion set has kept pressure on Ukrainian public-sector and defense targets by rotating malware while preserving the same operational patterns.
The ATM Malware Arrest That Exposes a Hidden Cash Pipeline
The reported FBI arrest tied to Ploutus is less about one fugitive and more about how ATM jackpotting blends local access, malware, and organized-crime finance.
npm’s Hidden Trap: A Long-Running MALFEX Campaign Turned Ordinary Installs Into Exposure Events
A supply-chain malware run tied to MALFEX has been active since August 2023, showing how package installs can become security events long before defenders notice.
When a Botnet Dresses Like STUN: Cling’s Quiet War on IoT Defenses
Cling turns a familiar NAT-traversal protocol into cover for command traffic, showing how old embedded-device flaws and ordinary network noise can be fused into one stealth layer.
Cling Botnet Hides Its Orders Inside a Traffic Pattern Defenders Trust
A botnet tied to exposed IoT and networking gear shows how attackers can blend command traffic into a common NAT-traversal protocol and make routine telemetry look harmless.
ClingSTUN Turns Forgotten Linux Boxes Into Silent Proxy Outposts
The malware chain is built for endurance: persistence at boot, concealment in the filesystem, and STUN-based connectivity that helps compromised devices stay reachable through NAT.
Hidden in Plain UDP: Cling Botnet Tries to Ride a Patched Realtek Flaw
Observed exploit attempts against Realtek Jungle SDK components show how edge-device malware can borrow legitimate network behavior to make command traffic look routine.
ClingSTUN Shows How Linux Malware Can Hide in Legitimate Network Noise
A reported Linux backdoor blends proxying, persistence, and self-propagation logic with STUN traffic, creating a detection problem that is more behavioral than signature-based.
When a Theme Turns Toxic: The VS Code Supply-Chain Angle Behind GlassWorm
A seemingly cosmetic editor add-on can become a delivery vehicle when extension packages carry executable code, not just colors.
The Browser Cache Trap: ClickFix Turns a Familiar Web Feature Into a Hiding Place
A Microsoft threat team analysis points to a ClickFix campaign that stashes malicious content in browser cache and dresses it up as a PNG, a reminder that ordinary web plumbing can become attacker cover.
The WordPress Backdoor That Would Not Stay Dead
A malware cluster codenamed SC appears to have survived cleanup by scattering its presence across files, database state, and shared memory, turning removal into a sequencing problem.
Inside SC: The WordPress Malware That Rebuilds Its Own Footholds
A newly studied WordPress malware family uses multiple persistence points across database and runtime layers, so removing one backdoor can still leave the rest ready to repopulate it within seconds.
DarkSword Raises a Harder Question Than Another Malware Alert
A named iPhone exploit kit, an Android mention, and a sensitive attribution claim point to a deeper problem: mobile targeting is increasingly about delivery paths, not just malicious apps.
When a Trusted GPT Becomes the Bait: ClickFix Turns AI Credibility into Malware Delivery
A reported campaign shows attackers using ChatGPT Custom GPTs as a trust layer, then handing victims off to ClickFix-style lure pages that can lead to remote access malware.
How a Supply-Chain Probe Surfaced a Hidden Malware Framework
NeedyMantis was not confirmed as a supply-chain payload itself, but investigators tracing DAEMON Tools indicators uncovered a modular post-compromise framework built for targeted intrusions.
When the Malware Site Stares Back: SilverFox’s New Trick
A reported SilverFox-linked campaign uses fake software pages that behave differently for researchers and potential victims, turning simple inspection into a moving target.
Fake Software, Real Risk: The Windows Installer Trap That Hides in Plain Sight
A branded download page can look harmless, but counterfeit installers remain one of the cleanest ways to turn routine software hunting into a compromise path.
BotHelper RAT Turns a Windows Screen Into a Remote Window for Spies
A newly documented Windows RAT combines stealth, persistence, and live desktop streaming, showing how a single host can become an operator’s interactive control panel.