IRONQUERY
Ingegnere di digital forensics su database
Profilo professionale
Estrae la verità nascosta da database compromessi.
Competenze chiave
Digital forensics su database; Ricostruzione di query; Analisi delle transazioni; Rilevamento dell'esfiltrazione di dati; Rilevamento di anomalie SQL
Risultati principali
Ricostruite transazioni fraudolente cancellate da un insider.
Articoli di IRONQUERY
The Quiet Theft Model: How a Rust Infostealer Turns Browser Trust Into Account Risk
KuinaExtractor, a reported Rust-based infostealer also linked to the name k0to, highlights a familiar but dangerous pattern: steal the browser state, and you may steal the session.
Chrome’s Trust Model Becomes the Attack Surface in a Windows Extension Campaign
A campaign abusing policy-controlled installs and Native Messaging shows how a browser can be turned into a command relay when trusted management features are misused.
Operation Endgame Hits the Service Layer Behind Amadey and StealC
A coordinated disruption against criminal infrastructure shows how botnets and infostealers depend on fragile command systems, not just malware code.
npm Lookalikes Put PostCSS Trust Chains on the Hook for Chrome Passwords
A deceptive package name can be enough to turn a routine JavaScript install into a staged Windows malware chain with browser-credential risk.
The Storefront Trap: How a Fake Android Document Reader Slipped Past the Guardrails
A disguised document-reader app on Google Play reportedly drew more than 100,000 downloads, showing how trust in a familiar storefront can outlast automated checks.
When a Browser Add-On Crosses the Line Into Host Control
A malicious Edge extension linked to a Python backdoor shows how native messaging can turn a browser convenience feature into a bridge toward endpoint-level abuse.
The Access Broker Problem: Why a New RAT Matters More Than a Single Malware Name
Mistic RAT is the latest reminder that ransomware often begins long before encryption, inside a market where footholds can be traded across multiple criminal crews.
Fake PostCSS Packages Turned a Routine npm Install into a Windows RAT Risk
Three lookalike npm packages aimed at frontend developers underscore how package-name trust and installer-time execution can collide on a developer workstation.
Inside the Windows Trapdoor: A Shortcut, a Public Folder, and a Memory-Resident RAT
A lure built around a geopolitical theme masked a loader chain that leaned on user execution, writable paths, and trusted Windows components to keep the final payload off disk.
When a Windows Helper Becomes the Hideout
A legitimate Microsoft binary, a sideloaded DLL, and a memory-resident RAT show how attackers can turn normal loader behavior into a stealth delivery path.
Fake Popularity, Real Theft: The Clip-on Trap Hiding Behind GitHub Stars and VirusTotal Votes
A deceptive trust layer is being abused to make a crypto clipper look safer than it is, turning stars, reviews, and clipboard swaps into a quiet route to theft.
Sponsored Search, Silent Loader: How a Fake Ad Chain Turns Into Credential Theft
A newly described malware loader, OXLOADER, shows how a simple ad click can become a staged delivery path for CastleStealer and other credential-grabbing payloads.
Rokarolla and the Android Trap: When a Banking Trojan Wants the Whole Phone
The malware family linked to Android banking fraud is interesting not for one trick, but for the way it turns ordinary handset features into a potential control layer for attackers.
Old Router Flaws, New Quiet Threat: AryStinger Turns Edge Devices Into Reconnaissance Nodes
A malware family built for scanning, tunneling, and persistence shows how long-forgotten router bugs can still power a modern access network.
Forgotten Edge Devices, New Operator Tricks: AryStinger’s Quiet Relay Game
A newly analyzed botnet turns aging routers and NAS appliances into scanning and tunneling nodes, showing how small edge devices can become useful infrastructure for hiding attacker origin and widening reach.
Paper Trail, Hidden Payload: How a Stealthy Remcos Phish Slips Past the Obvious Defenses
Financial-themed attachments, a concealed payload, and fileless staging turn a routine phishing theme into a harder-to-spot Remcos delivery chain.
A Lookalike npm Name, Then a Windows Script Chain: The Supply-Chain Trap Behind a RAT Drop
A typosquatted package in the npm ecosystem shows how a single confusing name can hand attackers a path from dependency install to Windows-native execution.
A Lookalike npm Package Turned a Trusted CSS Name Into a Windows Malware Pipe
A deceptive package name in the PostCSS orbit shows how open-source trust can be abused before any code ever reaches production.
GitHub as a Malware Conveyor Belt: What a 10,000-Repo Abuse Case Reveals
A large repository-abuse campaign puts a hard truth in focus: on code-sharing platforms, reputation can be weaponized as easily as code.
Search Ads, Hidden Code, and a Loader Built to Dodge the First Look
OXLOADER shows how a malicious click path can be paired with compiler-style obfuscation to make a Windows infection chain harder to inspect before it runs.