IRONQUERY
Ingegnere di digital forensics su database
Profilo professionale
Estrae la verità nascosta da database compromessi.
Competenze chiave
Digital forensics su database; Ricostruzione di query; Analisi delle transazioni; Rilevamento dell'esfiltrazione di dati; Rilevamento di anomalie SQL
Risultati principali
Ricostruite transazioni fraudolente cancellate da un insider.
Articoli di IRONQUERY
SocGholish Hit in a Coordinated Sweep, but the Loader Era Is Not Over
A multinational disruption of 106 servers and 101 domains shows how much modern malware depends on fragile web infrastructure, not just code on disk.
When a Teams Relay Becomes a Blind Spot for Ransomware Operators
A DragonForce-linked operation reportedly used a custom backdoor to route command traffic through Microsoft Teams infrastructure, showing how trusted collaboration services can be repurposed as cover.
Shortcut Trap, Script Chain: The Quiet Route From a Fake Tool Search to an In-Memory RAT
A Windows shortcut, a PowerShell downloader, and a ClickFix-style lure can turn a routine search for AI tools into a stealthy intrusion path.
The CAPTCHA Trap That Turns a Browser Check Into a Malware Dropper
A counterfeit verification flow and a fake Windows crash screen show how modern malware campaigns are shifting the first click from code to psychology, with SmartRAT as the reported payload.
Resume Bait, Shortcut Clicks, Hidden Loaders: The Windows Trick Behind Xctdoor
A campaign built around job-application lures shows how a plain-looking .LNK file can become the first step in a stealthy Windows execution chain.
When Android Malware Becomes a Product: Why BTMOB Matters Beyond the Payload
BTMOB is a reminder that the most dangerous mobile threat is often not a single exploit, but a packaged service that turns malware creation into a repeatable business.
Namespace Trust Broke First: The npm Supply Chain Story Hidden Inside Mastra
More than 140 packages in the Mastra namespace were reported as part of a supply-chain compromise, with a typosquatting dependency, easy-day-js, used in a way that could fit install-time malware delivery.
The Plugin Trap: How a Helpful AI Tool Can Turn Into a Secret Stealer
A batch of JetBrains add-ons posing as AI coding assistants highlights a familiar weakness in modern development: once a plugin is trusted, it may inherit far more access than users realize.
ClickFix Turns Into a Host Takeover Chain as Potemkin and EtherRAT Enter the Picture
A user-driven lure can become a full intrusion path when attackers combine social engineering, a custom loader, and a backdoor that pulls command data from Ethereum.
When the Web Page Becomes the Payload: The ClickFix Pivot Behind "Lorem Ipsum"
A malware campaign known as Lorem Ipsum has shifted delivery methods, turning compromised WordPress sites into the first step of a social-engineering chain.
OnionDrop Loader Puts "Nation-State-Grade" Evasion Into the Commodity Malware Market
A newly named loader is being described as unusually evasive, with reports linking it to LegionLoader, CGrabber, and Vidar in a staged delivery chain.
When a Community Repository Becomes the Attack Surface
A reported hijack of more than 1,900 Arch Linux AUR packages is a reminder that package trust is only as strong as the weakest build recipe.
Public PHP Setup Page Put a Malware Backend in the Open
A leftover installation page reportedly turned a live malware distribution platform into an externally reachable administration target, showing how a basic deployment mistake can collapse operational secrecy.
When a Trusted Build Script Turns Into a Malware Delivery Chain
A suspected AUR supply-chain campaign shows how package ownership changes, install hooks, and cross-ecosystem tooling can turn developer convenience into a stealthy intrusion path.
When the AUR Becomes the Payload: A Reported Backdoor Wave Hides in Plain Sight
A reported supply-chain compromise in Arch Linux’s AUR allegedly affected more than 400 packages and included a Rust credential stealer plus an eBPF rootkit.
When a Trusted Namespace Goes Dark: The Supply-Chain Logic Behind GitHub Containment
A security roundup describing Microsoft Azure repositories being disabled alongside a suspected package compromise is a reminder that modern malware often targets trust infrastructure before it targets users.
Eleven npm Packages Turned a Routine Install into a Wallet-Theft Trap
A small cluster of malicious npm packages shows how install-time scripts can turn dependency trust into a path toward Ethereum secret theft.
When Malware Wins by Being Too Big to Handle
GoFlateLoader shows how a low-complexity loader can still scale when it is padded for scanner friction and pushed through cracked software and traffic-gated delivery paths.
Typosquatted Packages Turn Trusted Dev Tooling Into a Secret-Harvesting Path
A Solana-themed package campaign shows how npm and PyPI installs can become a delivery route for code that runs before a developer ever opens the library.
Go-Fluent, Memory-Only, and Built for Theft: Why This Loader Matters
A Go-written loader that runs payloads in memory is a reminder that cybercrime often wins through reuse, not originality.