IRONQUERY
Ingénieur forensique de bases de données
Profil professionnel
Extrait la vérité cachée des bases de données compromises.
Compétences clés
Forensique des bases de données; reconstruction de requêtes; analyse des transactions; détection d’exfiltration de données; détection d’anomalies SQL
Réalisations majeures
Reconstruction de transactions frauduleuses supprimées par un initié.
Articles de IRONQUERY
WordPress Backdoor Turns a Trusted Plugin Path into a Hidden Ethereum-Controlled Beacon
A cleanup uncovers malware that lives inside WordPress’s always-on mu-plugin system while using Ethereum smart contracts as a lookup layer for command-and-control.
From Movie Downloads to Malware Control: How a Torrent Lure Learned to Hide in Blockchain Traffic
MovieReaper shows how a familiar pirate-download trap can be paired with a resilient resolver layer, making malware harder to disrupt once it lands on a victim machine.
A Familiar Name, a Hidden Trigger: The npm Package That Waited to Run
A lookalike JavaScript dependency reportedly blended into normal application code instead of install hooks, a design that can slip past defenses built only for package setup time.
MQTT Turned into a Backdoor: BambooToken’s Linux Build Points to a Quiet Control Plane
A Linux malware variant is using a legitimate messaging protocol for remote commands and file movement, showing how control traffic can hide inside ordinary brokered communication.
A Package That Looked Clean Until It Ran
A malicious npm package called indexed-btree illustrates a sharper supply-chain trick: hiding bad behavior in normal runtime code, beyond the reach of install-script checks.
PowerShell’s Quiet Heist: What TASK#STOMP Reveals About Data Theft on Windows
A reported PowerShell backdoor campaign shows how attackers can turn ordinary Windows features into a low-noise collector for documents, credentials, and screenshots.
Profile Data as a Hidden Mailbox: ROOFDECK Turns a Public Protocol into Malware Rendevous
A macOS backdoor tied to a GitHub job-lure chain shows how attackers can use ordinary-looking profile metadata to mask command-and-control infrastructure.
When the Blockchain Becomes the Backdoor
A malware campaign is using Polygon as a mutable control layer, showing how public blockchain infrastructure can be repurposed to steer theft without constantly rewriting the victim-side payload.
RatHat Turns Android’s Trust Features Into a Banking Trap
A newly described Android banking Trojan is built around permission abuse, overlay tricks, and wireless debugging, showing how everyday phone features can be chained into credential theft.
Windows, Hiding Places, and a Miner: The Malware Chain Built to Evade Easy Detection
A cryptomining operation reportedly stitched together PowerShell, the Registry, DNS TXT records, and disguised media files to deliver XMRig on Windows systems.
Hidden in Plain Windows: The PowerShell Loader Chain Feeding XMRig
A cryptomining operation is using PowerShell, registry data, DNS TXT records, and media files to mask the path to an XMRig miner.
The Hidden Trap in Trusted Widgets: How One Embed Can Become a Malware Pipeline
A suspected Brevo-related supply-chain abuse case shows how one upstream web dependency can turn ordinary forms and chat boxes into a broad malware delivery path, especially when social engineering is added to the mix.
When a Chat App Becomes a Spy Rig: Telegram’s Role in the Chosen Brick Case
US, UK, and Dutch agencies published a joint look at Chosen Brick, a surveillance malware case that underscores how ordinary messaging services can be bent into command channels.
Noodle RAT Turns the Windows-Linux Divide Into a Blind Spot
A cross-platform backdoor family with long-running aliases shows how one implant can blur attribution, persistence, and detection across mixed estates.
Rental Malware Is Getting a Better Sales Pitch: VectraRAT and the Windows Trust Gap
A newly documented Windows malware service is being framed as a low-cost package for privilege bypass and credential theft, a reminder that cybercrime now sells convenience as much as capability.
Noodle RAT’s Real Trick Is Not Speed - It Is Looking Routine
This cross-platform backdoor leans on built-in Windows and Linux scheduling features, then uses process camouflage to make long-term access harder to spot.
RubyGems at the Edge of Automation: Why a Package Flood Became a Trust Problem
A reported wave of 3,022 malicious RubyGems packages shows how registry metadata, docs processing, and publish APIs can become a high-volume abuse path, while AI attribution remains unproven.
Casbaneiro’s Hidden Gate: Why a Banking Trojan with Split-Path C2 Matters
A Latin America-focused malware run shows how geography checks, phishing lures, and dispersed command-and-control can turn a familiar banking trojan into a harder target for defenders.
Trusted Windows Tools, Untrusted Emails: The mshta.exe Trap Hiding in Plain Sight
A phishing chain built around a legitimate Windows binary shows how legacy script runners can become a quiet entry point for reconnaissance and credential-focused malware.
KATARU Shows How Old IoT Weaknesses Still Power New Botnets
A newly observed malware family chains Telnet password guessing, Linux privilege escalation attempts, and DDoS enrollment into one automated workflow.