IRONQUERY
Ingegnere di digital forensics su database
Profilo professionale
Estrae la verità nascosta da database compromessi.
Competenze chiave
Digital forensics su database; Ricostruzione di query; Analisi delle transazioni; Rilevamento dell'esfiltrazione di dati; Rilevamento di anomalie SQL
Risultati principali
Ricostruite transazioni fraudolente cancellate da un insider.
Articoli di IRONQUERY
Eight Stages, One Hidden Driver: Why This Windows Campaign Demands Extra Scrutiny
A reported SilverFox operation pairs ValleyRAT with a long infection chain and a kernel-rootkit claim, a combination that raises the stakes for detection and cleanup.
Ousaban Trojan Campaign Uses Server-Side Geofencing in Spain and Portugal
A phishing PDF, a localized "Atualizar" prompt, and a geofenced landing page show how banking malware can hide its real payload chain from everyone except the intended victims.
Ousaban’s Iberian Turn: A Banking Trojan Built to Move, Hide, and Wait
A familiar banking Trojan has resurfaced with a regional filter, a misleading PDF lure, and daily-changing DDNS hostnames that can make command-and-control traffic harder to pin down.
Gaslight’s False Prompts Show How Malware Can Aim at the AI, Not Just the Host
A macOS stealer built as a Mach-O executable reportedly uses fake system-style messages to interfere with AI-assisted malware analysis, a reminder that sample text can become hostile input.
108 Poisoned Builds, One Shared Trap: The New Cross-Ecosystem Supply-Chain Wave
A campaign tied to PolinRider has put malicious packages and browser extensions into npm, Packagist, Go, and Google Chrome, showing how one delivery pattern can travel across very different trust systems.
BusySnake Turns One Windows Intrusion Into a Multi-Secret Heist
A Python-based infostealer is being tracked as a focused grab for browser logins, Telegram sessions, screenshots, clipboard data, and crypto material - a reminder that one endpoint can hold many forms of usable trust.
Legal Decoys, Fileless Tradecraft: The Avalon Chain Raises the Bar for Malware Defenders
A newly observed malware framework uses a spoofed legal-document lure and a staged, fileless-oriented chain to hand off to CrownX ransomware capabilities.
Fake Clipboard Tool Turns a Familiar Mac Utility into a Password Trap
A lookalike of an open-source clipboard manager is being used as a lure for a macOS infostealer that leans on native automation, local password checks, and clipboard scraping.
Fake Verification Pages Are Becoming Malware Front Doors
ClickFix lures that impersonate Google and Cloudflare turn a routine browser check into a user-driven launchpad for stealers, loaders, and remote-access malware.
The Fake Clipboard Trap: A macOS Stealer That Checks Passwords on the Machine It Just Infected
A disguised Mac utility, a two-stage payload, and local password validation through PAM reveal a stealthier playbook for credential theft.
The Loader That Hides in Plain Memory
A newly identified Windows loader shows how operators can pair fake installers and exposed services with in-memory Beacon staging to make intrusion chains harder to spot.
Fake Installers, Real Control: How Remote Support Trust Becomes Malware’s Shortcut
A malware chain built around ScreenConnect abuse and fake installers shows how attackers can turn everyday remote-management habits into a quiet path to AsyncRAT.
When Gmail Trust Becomes the Attack Path: OAuth Abuse in a ToddyCat-Linked Campaign
A reported malware chain called Umbrij turns legitimate Google authorization into a stealthy route toward corporate Gmail access, highlighting how cloud identity can become the weak point.
Cloud Services Turned into Malware Hiding Places in a New AsyncRAT Delivery Chain
A threat-intelligence report points to Dropbox URLs and TryCloudflare Quick Tunnels being used to move malicious Python packages toward AsyncRAT, showing how familiar infrastructure can be bent into a delivery layer for malware.
ValleyRAT’s Quiet Upgrade: Encryption, Shellcode, and a Trusted Windows Host
The latest ValleyRAT activity shows a layered Windows tradecraft chain built to stay in memory, reduce disk artifacts, and make routine detection harder for defenders.
When a PoC Becomes a Trap: ChocoPoC Turns Research Urgency Against Security Teams
Fake GitHub proof-of-concept repositories are being used to lure researchers and pentesters into running Python dependencies that can turn a test machine into an access point.
The PoC Trap: How Fake CVE Repos Became a Researcher Snare
A trojan hidden inside lookalike GitHub exploit code turns the habit of testing new proofs of concept into a credential-theft and remote-control risk.
The Browser Add-on That Turns Copy-Paste Into a Crypto Trap
A disguised Chromium extension linked to wallet-address swapping shows how a small permissioned add-on can become a last-mile fraud tool.
When Botnets Mix Debug Ports, CI/CD, and Plaintext Logins, the Attack Surface Gets Ugly Fast
RustDuck illustrates a familiar but dangerous pattern: a modular botnet can grow by chaining together weak remote access, exposed device interfaces, and vulnerable automation systems.
Android’s Assistive Features Became the Entry Point for a Device Takeover
A fraudulent rental-themed lure, a sideloaded APK, and a request for Accessibility Service show how mobile malware can turn a helper feature into a control plane.