IRONQUERY
Ingénieur forensique de bases de données
Profil professionnel
Extrait la vérité cachée des bases de données compromises.
Compétences clés
Forensique des bases de données; reconstruction de requêtes; analyse des transactions; détection d’exfiltration de données; détection d’anomalies SQL
Réalisations majeures
Reconstruction de transactions frauduleuses supprimées par un initié.
Articles de IRONQUERY
Known Malware, New Noise: npm’s Dormant Worm Reappears With a Familiar Fingerprint
A resurfacing malicious npm payload shows how supply-chain threats can return unchanged, turning old indicators into a live operational test for registry defenses and developer hygiene.
When a Remote Support Client Becomes the Delivery Vehicle
Modified ScreenConnect clients are tied to a worm-like campaign that uses backdoored instances to transfer and execute payloads on newly connected clients.
The Malware That Leaves After It Leaves: REVSTEALER’s Hidden Second Act
A Windows stealer that deletes itself may sound like a cleanup success, but the real risk is what remains behind: follow-on code that can suppress defenses and push an infected host into mining duty.
When a Malware Search List Swallows the Developer Stack
A newer Shai-Hulud variant now checks 469 locations for secrets, showing how credential theft is following the sprawl of developer, cloud, and AI tooling.
Trusted Code, Hidden Intent: How Node.js Became a Delivery Path for Targeted Malware
A legitimate JavaScript runtime is being repurposed in targeted intrusions, forcing defenders to look beyond file reputation and toward process behavior.
When a Fake Streaming App Meets Android's Most Dangerous Permissions
A malvertising campaign turned familiar Android features into a control stack for banking fraud, showing how social engineering can be as powerful as code.
A Critical Appliance Flaw Hits the Exploited-Vulnerabilities List as Attackers Chase Shells and Miners
A pre-authentication SSRF in SonicWall SMA 1000 firmware has moved into CISA’s active-exploitation tracker, a sign that edge-device bugs are being turned into live footholds, not just patch notes.
Streaming Lure, Silent Hands: How StreamRAT Turns Android Permissions into Remote Control
A streaming-themed Android campaign shows how a single accessibility grant, paired with VNC-style control, can turn a consumer phone into an operator-driven device.
Fake Download Pages Turn Familiar Brands Into Malware Traps
A counterfeit-software scheme has pushed malicious installers through look-alike download pages, showing how attackers can weaponize trust in common names, official-looking sites, and routine software updates.
When a Blockchain Becomes the Back Office for Malware
A ClickFix-linked campaign shows how attackers can pair user trickery with on-chain infrastructure to rotate command links without relying on a single vulnerable server.
Wallet-Branded Installers Are Becoming Perfect Delivery Vehicles for Browser Theft
A trojanized Exodus wallet installer is being used to drop a modular RAT that focuses on credentials, cookies, and live operator access rather than a quick hit on crypto balances.
Fake Download Pages Became the Door: A Counterfeit Installer Campaign Eyes China’s Workstations
A brand-cloning lure built around familiar software names shows how one mistaken download can turn a routine install into an initial access problem.
Fake Installers, Real Risk: How Brand Clones Turn Windows Downloads Into Entry Points
A malware campaign using counterfeit pages for Microsoft Edge, Kaspersky, and Razer shows how ordinary software-seeking behavior can become an initial-access trap on Windows.
When a Botnet’s Own Mesh Becomes the Trap
A multinational disruption of Sality shows how peer-to-peer malware can be weakened when defenders understand the protocol well enough to interfere with its trust layer.
Sality’s Long Game Interrupted: How Defenders Hit a P2P Botnet Where It Communicates
A 23-year-old malware network was disrupted by targeting the way it finds peers and the web locations it uses to pull payloads.
When the Kernel Goes Quiet: A Rootkit Tactic That Can Starve Linux Defenders of Telemetry
A disclosed bypass tied to the Singularity Linux rootkit shows how module-load visibility, not just files or processes, can become the first thing attackers try to silence.
When a Linux Rootkit Turns the Sensor Against Itself
A research demo against Elastic Defend highlights a harder problem for Linux security: if the kernel telemetry path can be tampered with, the alert may never fire.
The Backdoor That Sleeps in a Trusted Agent Until the Right Packet Knocks
SLEEPWALKER shows how Windows DLL side-loading and trigger-based activation can turn a normal management process into a stealthy hiding place.
SLEEPWALKER Turns the Usual Malware Playbook Inside Out
This Windows backdoor does not appear to live on noisy beaconing alone - it can wait for a trigger, then move tasking through DNS, VMware VMCI, named pipes, and memory-only execution paths.
When Trust Becomes the Payload: ValleyRAT’s Quiet Infiltration of a Signed Utility
A Windows backdoor linked to Silver Fox was disguised inside a signed wallpaper app, turning software trust and antivirus exclusions into part of the intrusion path.