IRONQUERY
Ingegnere di digital forensics su database
Profilo professionale
Estrae la verità nascosta da database compromessi.
Competenze chiave
Digital forensics su database; Ricostruzione di query; Analisi delle transazioni; Rilevamento dell'esfiltrazione di dati; Rilevamento di anomalie SQL
Risultati principali
Ricostruite transazioni fraudolente cancellate da un insider.
Articoli di IRONQUERY
The World Cup T-Shirt Trap: How a Familiar Lure Can Carry Malware
A fake FIFA World Cup 2026 merchandise offer shows how personalized branding and trusted web infrastructure can turn an inbox novelty into a malware delivery path.
When Guest Complaints Become Malware Cover: The Hotel Phishing Campaign Built on TON
A targeted lure against Japan’s hotel sector shows how complaint-themed emails and blockchain-backed infrastructure can be paired to make malware harder to disrupt.
The Browser Add-on That Turned Search Into a Trap
A Chromium extension posing as an AI search helper shows how browser trust can be bent with branding, redirect rules, and page-level scripting.
STOCKSTAY and the Quiet Art of Looking Legitimate
A .NET backdoor tied to stealthy WebSocket command traffic and environment-based keying shows how modern malware can hide inside ordinary application behavior.
Edge’s Quiet Backdoor: 119 Extensions Pulled After a Hidden-Payload Campaign
A browser add-on operation blended ordinary image and font assets with delayed malicious behavior, showing how marketplace trust can be abused long after an extension passes initial review.
Malicious Packages Take the Editor Route: npm and Go Code Abuse VS Code Tasks for Stealth
A package-chain compromise can do more than slip in bad code - it can turn developer tooling itself into the execution path for a cross-platform Python infostealer.
Fallback Domains, Fake App Sites, and the Android Trapdoor Behind Rokarolla
The malware campaign tied to Rokarolla shows how mobile fraud tooling can survive pressure on one control channel by pairing impersonation sites with backup command infrastructure and permission abuse.
Millenium RAT Hides Its Tracks in a Native C++ Build and Telegram-Borne C2
The malware’s latest variant pairs resource-embedded settings with Base64 and XOR obfuscation, making its control plane harder to spot without deeper binary triage.
Millenium RAT v4.* Shifts to Telegram-Controlled Windows Tasking
A Windows remote-access trojan tied to a MaaS model is being linked to Telegram Bot API tasking and a move away from .NET toward native C++ code.
Archive Lure, Secret Harvest: Why a WinRAR-Based Stealer Chain Deserves More Attention
A reported GIFTEDCROOK campaign shows how a seemingly ordinary archive can be turned into a delivery path for browser, vault, VPN, and document theft.
Fake Safety, Real Theft: Rokarolla Turns Android Trust Into a Banking Trap
A counterfeit Google Play Protect lure shows how mobile malware can use familiar brands, accessibility abuse, and overlays to pressure users into handing over financial access.
Chrome’s Cookie Shield Meets a Rust-Built Burglar
A tracked infostealer family kept changing shape, and its latest move highlights how browser protections and session theft are locked in a race that defenders cannot afford to lose.
The Quiet Theft Model: How a Rust Infostealer Turns Browser Trust Into Account Risk
KuinaExtractor, a reported Rust-based infostealer also linked to the name k0to, highlights a familiar but dangerous pattern: steal the browser state, and you may steal the session.
Chrome’s Trust Model Becomes the Attack Surface in a Windows Extension Campaign
A campaign abusing policy-controlled installs and Native Messaging shows how a browser can be turned into a command relay when trusted management features are misused.
Operation Endgame Hits the Service Layer Behind Amadey and StealC
A coordinated disruption against criminal infrastructure shows how botnets and infostealers depend on fragile command systems, not just malware code.
npm Lookalikes Put PostCSS Trust Chains on the Hook for Chrome Passwords
A deceptive package name can be enough to turn a routine JavaScript install into a staged Windows malware chain with browser-credential risk.
The Storefront Trap: How a Fake Android Document Reader Slipped Past the Guardrails
A disguised document-reader app on Google Play reportedly drew more than 100,000 downloads, showing how trust in a familiar storefront can outlast automated checks.
When a Browser Add-On Crosses the Line Into Host Control
A malicious Edge extension linked to a Python backdoor shows how native messaging can turn a browser convenience feature into a bridge toward endpoint-level abuse.
The Access Broker Problem: Why a New RAT Matters More Than a Single Malware Name
Mistic RAT is the latest reminder that ransomware often begins long before encryption, inside a market where footholds can be traded across multiple criminal crews.
Fake PostCSS Packages Turned a Routine npm Install into a Windows RAT Risk
Three lookalike npm packages aimed at frontend developers underscore how package-name trust and installer-time execution can collide on a developer workstation.