IRONQUERY
Ingegnere di digital forensics su database
Profilo professionale
Estrae la verità nascosta da database compromessi.
Competenze chiave
Digital forensics su database; Ricostruzione di query; Analisi delle transazioni; Rilevamento dell'esfiltrazione di dati; Rilevamento di anomalie SQL
Risultati principali
Ricostruite transazioni fraudolente cancellate da un insider.
Articoli di IRONQUERY
When a Mac Stealer Learns Your Secrets, the Crypto Raid Can Happen Later
A macOS-focused information stealer detected by MistEye is reported to collect wallet databases, Keychain material, browser data, and Apple Notes, then use those fragments for offline cryptocurrency theft attempts.
Old Rootkit, New Shadow: Daxin’s Return Shows How Windows Intrusions Hide in Plain Traffic
A resurfaced backdoor and a separate DLL implant found on the same Windows host highlight how attackers can combine low-level network manipulation with logon-time persistence.
The Botnet That Turns Bad Password Hygiene Into a DDoS Factory
A modular IoT malware framework shows how exposed Linux devices, Telnet, and layered persistence can turn routine neglect into a durable attack platform.
When a Trusted npm Namespace Turns Into a Delivery Channel for Malware
Four AsyncAPI packages were reportedly republished with malicious releases described as a RAT-focused Miasma build, while automatic propagation was disabled.
Poisoned Packages, Quiet Secrets: The Jscrambler npm Case Exposes a Familiar Trap
Multiple npm package versions tied to Jscrambler were poisoned in a supply chain attack, showing how a trusted update path can become the delivery mechanism for credential-stealing malware.
The Malware That Could Change Its Face: Why Adaptive Worms Matter
Research concepts around self-replicating, environment-aware malware point to a harder problem for defenders: code that may not stay still long enough for signature-based tools to catch it.
When a Visual Studio Project Becomes the Doorway: The Siggen Developer Trap
A Windows backdoor reported against developers shows how trusted build files and familiar services can be turned into stealthy malware infrastructure.
When a Build File Turns Hostile: The Quiet Malware Risk Inside Visual Studio Projects
A Windows Trojan documented in late 2025 is a reminder that in modern development, project files can become attack surface, not just configuration.
When a Build File Becomes the Breach Door
A multi-stage Trojan tied to Visual Studio project files shows how ordinary build logic can turn into a supply-chain attack surface.
The Server That Betrayed the Hunters Behind a WordPress Backdoor Wave
An internet-facing operator box leaked tools, logs, and target lists, turning a mass WordPress campaign into a rare view of how web intrusions are organized.
Hundreds of GitHub Repositories, One Malware Chain: The New Shape of Windows Staging
A staged abuse pattern built on public code hosting, Go, PowerShell, and dead-drop indirection shows how ordinary developer infrastructure can be repurposed for malware delivery.
GigaWiper Turns Windows Access Into a Sabotage Tool
Microsoft’s warning points to a troubling hybrid: a Go-based backdoor that can keep a foothold, collect data, and pivot into destructive action against Windows systems.
A Publicly Exposed Banana RAT Builder Turned Malware Plumbing Into a Clue
An open internet host reportedly leaked staging files plus build and obfuscation tooling, offering a rare look at how a RAT family may be assembled before it reaches victims.
Fake CAPTCHA, Real Commands: The Human Operator Behind a Banking Malware Playbook
A reported Mexican fraud operation blends ClickFix-style deception with PowerShell execution, showing how a single pasted command can become the first step in an operator-assisted compromise.
Underground Mycelium Ad Casts Compromised Windows and Linux Hosts as Reusable Compute
The pitch is unverified, but the mechanics are familiar: encrypted command channels, persistence, credential theft, and lateral movement wrapped in a new criminal brand.
Inside the Banana RAT Build Host: A Hidden Server Exposed the Malware’s New Disguise
An open directory tied to Banana RAT exposed how the malware family is changing its Windows footprint, moving from fixed Microsoft-themed artifacts to randomized ProgramData paths.
Kazuar’s Old Trick, New Pressure: Trusted Processes Become the Hideout
The backdoor linked to Turla has resurfaced with a loader chain built around DLL side-loading and PowerShell, a combination that can shrink obvious disk artifacts and complicate basic allowlist-based defenses.
Verification Theater Turns Into Malware Delivery
Fake Google and Cloudflare-style checks are being used as trust lures in a ClickFix chain that reportedly delivered multiple malware families, including StealC and NetSupport.
Eight Stages, One Hidden Driver: Why This Windows Campaign Demands Extra Scrutiny
A reported SilverFox operation pairs ValleyRAT with a long infection chain and a kernel-rootkit claim, a combination that raises the stakes for detection and cleanup.
Ousaban Trojan Campaign Uses Server-Side Geofencing in Spain and Portugal
A phishing PDF, a localized "Atualizar" prompt, and a geofenced landing page show how banking malware can hide its real payload chain from everyone except the intended victims.