IRONQUERY
Ingénieur forensique de bases de données
Profil professionnel
Extrait la vérité cachée des bases de données compromises.
Compétences clés
Forensique des bases de données; reconstruction de requêtes; analyse des transactions; détection d’exfiltration de données; détection d’anomalies SQL
Réalisations majeures
Reconstruction de transactions frauduleuses supprimées par un initié.
Articles de IRONQUERY
When a Chat App Becomes a Spy Rig: Telegram’s Role in the Chosen Brick Case
US, UK, and Dutch agencies published a joint look at Chosen Brick, a surveillance malware case that underscores how ordinary messaging services can be bent into command channels.
Noodle RAT Turns the Windows-Linux Divide Into a Blind Spot
A cross-platform backdoor family with long-running aliases shows how one implant can blur attribution, persistence, and detection across mixed estates.
Rental Malware Is Getting a Better Sales Pitch: VectraRAT and the Windows Trust Gap
A newly documented Windows malware service is being framed as a low-cost package for privilege bypass and credential theft, a reminder that cybercrime now sells convenience as much as capability.
Noodle RAT’s Real Trick Is Not Speed - It Is Looking Routine
This cross-platform backdoor leans on built-in Windows and Linux scheduling features, then uses process camouflage to make long-term access harder to spot.
RubyGems at the Edge of Automation: Why a Package Flood Became a Trust Problem
A reported wave of 3,022 malicious RubyGems packages shows how registry metadata, docs processing, and publish APIs can become a high-volume abuse path, while AI attribution remains unproven.
Casbaneiro’s Hidden Gate: Why a Banking Trojan with Split-Path C2 Matters
A Latin America-focused malware run shows how geography checks, phishing lures, and dispersed command-and-control can turn a familiar banking trojan into a harder target for defenders.
Trusted Windows Tools, Untrusted Emails: The mshta.exe Trap Hiding in Plain Sight
A phishing chain built around a legitimate Windows binary shows how legacy script runners can become a quiet entry point for reconnaissance and credential-focused malware.
KATARU Shows How Old IoT Weaknesses Still Power New Botnets
A newly observed malware family chains Telnet password guessing, Linux privilege escalation attempts, and DDoS enrollment into one automated workflow.
MacSync Turns Mac Trust Into a Trap, Using Fake Fixes to Chase Passwords and Wallets
A macOS stealer campaign built around social engineering shows how copy-paste deception can matter more than a software bug.
When the Web Shell Lives in Memory, the Disk Tells a Lie
A malicious PHP implant tied to F5 BIG-IP APM tampering shows why defenders must check what an appliance serves at runtime, not just what its files look like on disk.
Infostealers Turn AI Coding Assistants Into a Fresh Credential Cache
A familiar malware class is widening its net from browser secrets to local data left behind by AI developer tools, raising the stakes for workstation security.
AI Tools Meet Zero-Click Messaging Risk in a WeChat Worm Demo
A Palo Alto-based security team has put a fast-moving question on the table: when AI helps build exploit code in days, how much warning time do defenders really get?
When a Ring Becomes a Breach: The WeChat Call Path That Could Move Like Malware
A demonstrated zero-click chain on iPhone and Android shows how an incoming call can become an account-takeover path when trust is baked into the wrong part of the app.
Reverse Shells, Not Sliver: The Quiet Windows Foothold Behind a Ransomware Probe
A Windows intrusion tied to a ransomware investigation appears to have relied on reverse shells, credential-theft tooling, service masquerading, and Ethereum-based command control, with one early Sliver readout later corrected.
When a Trusted Registry Turns on Its Users
A redirected module registry can turn ordinary infrastructure automation into a credential risk, especially when Terraform pulls code before anyone notices the path changed.
One Old npm Payload, One Fragile Filter, and a Supply Chain Still on Edge
A known Shai-Hulud npm payload resurfaced after 111 days, putting registry-side malware screening under the microscope and reminding defenders that package installs can be an execution path, not just a download.
Known Malware, New Noise: npm’s Dormant Worm Reappears With a Familiar Fingerprint
A resurfacing malicious npm payload shows how supply-chain threats can return unchanged, turning old indicators into a live operational test for registry defenses and developer hygiene.
When a Remote Support Client Becomes the Delivery Vehicle
Modified ScreenConnect clients are tied to a worm-like campaign that uses backdoored instances to transfer and execute payloads on newly connected clients.
The Malware That Leaves After It Leaves: REVSTEALER’s Hidden Second Act
A Windows stealer that deletes itself may sound like a cleanup success, but the real risk is what remains behind: follow-on code that can suppress defenses and push an infected host into mining duty.
When a Malware Search List Swallows the Developer Stack
A newer Shai-Hulud variant now checks 469 locations for secrets, showing how credential theft is following the sprawl of developer, cloud, and AI tooling.