IRONQUERY
Ingegnere di digital forensics su database
Profilo professionale
Estrae la verità nascosta da database compromessi.
Competenze chiave
Digital forensics su database; Ricostruzione di query; Analisi delle transazioni; Rilevamento dell'esfiltrazione di dati; Rilevamento di anomalie SQL
Risultati principali
Ricostruite transazioni fraudolente cancellate da un insider.
Articoli di IRONQUERY
Package Trust, Broken Open: The TrapDoor Playbook Inside Developer Workflows
A cross-registry supply chain campaign shows how ordinary package installs can turn into secret-harvesting events for cloud, SSH, and wallet credentials.
TrapDoor and the Quiet Theft Path Hidden Inside Trusted Package Installs
A reported cross-registry package campaign shows how ordinary install and build workflows can become secret-harvesting channels for developer systems.
Trusted Names, Rogue Releases: The npm Supply Chain Trap Hidden in Plain Sight
Malicious versions pushed into the @redhat-cloud-services namespace show how a familiar package name can become a credential-harvesting path for developers and CI/CD systems.
When npm Trust Becomes the Attack Path: A Credential-Stealing Worm Reaches the Release Line
A compromise in the package publication chain can turn trusted automation into a delivery system for secret theft and repeat infection.
17 Million Infected Devices, One Choke Point: Inside a Botnet Disruption
Dutch authorities say they disrupted a botnet tied to at least 17 million infected devices, a case that shows how control infrastructure, not just endpoints, can become the fastest path to damage reduction.
The Fake RVTools Trap: How a Trusted Installer Can Smuggle in a Backdoor
A counterfeit VMware utility, a legitimate code-signing certificate, and a staged Python payload show how attackers can turn reputation into an entry point.
Windows Consoles in the Crosshairs: Why .MSC Files Have Become a Stealthy APT Tool
A familiar Microsoft administration format is being treated as a low-friction execution path, and that matters because trusted system tools are often the hardest ones to watch.
Windows Trust, Weaponized: PureLogs, MSBuild, and the Quiet Art of Process Hollowing
A reported PureLogs campaign blends phishing attachments, a legitimate Microsoft build tool, and memory-injection tradecraft to target credentials and wallet data.
When Malware Starts Renting Space on a Blockchain
ClearFake’s use of EtherHiding on BNB Smart Chain testnet smart contracts shows how on-chain storage can complicate the hunt for command-and-control infrastructure.
Fake Interviews, Real Theft: How InvisibleFerret Turns Developer Trust Into an Entry Point
Developer job lures are being used to deliver InvisibleFerret, a malware family tied to browser credential theft, crypto wallet targeting, and risky access to CI/CD environments.
When a Build Tool Becomes Cover: The PureLogs Campaign Hiding Behind MSBuild
A phishing lure dressed as a purchase order is being paired with MSBuild abuse and process hollowing, a combination that turns ordinary Windows trust into a stealth path for infostealer activity.
BTMOB Pushes Android Malware Beyond Theft and Into Remote Control
A newly observed Android RAT is drawing attention because its value is not just in stealing data, but in giving an operator practical control over a victim’s phone once it is installed.
When a Single Image Can Become a Payment Scam on Older iPhones
A reported zero-click chain linking WhatsApp for iOS and Apple’s ImageIO framework highlights how legacy iPhones can turn a chat app into a stealthy fraud surface.
Ghost CMS Poisoned Pages Turn Trusted Sites Into ClickFix Traps
A reported Ghost CMS exploitation chain shows how one web publishing flaw can be turned into a browser-based lure that blends legitimate pages with malicious JavaScript.
When Tags Turn Toxic: The Laravel-Lang Poisoning Case and the Hidden Risk in CI
Malicious package tags published in a short window turned a routine dependency path into a potential route for stealing build-time secrets.
Search Results Became the Bait in a New Software-Download Ambush
A lure built around SQL Developer shows how a threat cluster can turn user search intent into a delivery channel for malware, without relying on email at all.
Compiled Python, Fake Interviews, and the New Shape of Developer Bait
A malware campaign described through InvisibleFerret shows how recruiting lures and native-looking Python artifacts can collide inside a developer workflow.
I download fasulli di strumenti AI trasformano i risultati di ricerca in una trappola per sviluppatori
Un’esca costruita attorno a Gemini CLI e Claude Code mostra come il SEO poisoning possa indirizzare gli sviluppatori verso un infostealer PowerShell fileless.
Una dipendenza silenziosa si è trasformata in una trappola per credenziali
Una compromissione di diversi pacchetti PHP Laravel-Lang mostra come un percorso di aggiornamento poco visibile possa diventare un canale di distribuzione ad alta fiducia per il furto di credenziali.
Vecchie falle nei router, nuova potenza per il botnet: perché un bug ASUS del 2018 è ancora importante
Una vulnerabilità di autenticazione nota da tempo nei router ASUS è riapparsa come strumento utile per RondoDox, mostrando come bug datati sui dispositivi edge possano ancora alimentare campagne botnet moderne.