The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

PCI DSS 4.0 encourages the implementation of anti-phishing controls like DMARC! This highlights and reinforces the importance of preventative measures against email fraud, domain spoofing, and phishing in the financial space. While not a mandate or a requirement for PCI DSS compliance, DMARC and supporting email authentication technologies like SPF and DKIM play a pivotal role in protecting domain names against misuse.  Organizations can sign up for a DMARC analyzer trial to simplify their DMARC implementation, without the need for technical expertise. With more than 94% of organizations falling victim to phishing, this is the cue for businesses of all sizes to strengthen domain security and prevent the next big cyber attack. Many organizations turn to email authentication management solutions like PowerDMARC to simplify implementation, monitor authentication, and ensure continuous protection. On the flip side, it also presents a golden opportunity for MSPs to sell DMARC to th...

A previously unknown threat activity cluster targeted European organizations, particularly those in the healthcare sector, to deploy PlugX and its successor, ShadowPad, with the intrusions ultimately leading to deployment of a ransomware called NailaoLocker in some cases. The campaign, codenamed Green Nailao by Orange Cyberdefense CERT, involved the exploitation of a now-patched security flaw in Check Point network gateway security products ( CVE-2024-24919 , CVSS score: 7.5). The attacks were observed between June and October 2024. "The campaign relied on DLL search-order hijacking to deploy ShadowPad and PlugX – two implants often associated with China-nexus targeted intrusions," the company said in a technical report shared with The Hacker News. The initial access afforded by exploitation of vulnerable Check Point instances is said to have allowed the threat actors to retrieve user credentials and to connect to the VPN using a legitimate account. In the next stage,...

A malware campaign distributing the XLoader malware has been observed using the DLL side-loading technique by making use of a legitimate application associated with the Eclipse Foundation. "The legitimate application used in the attack, jarsigner, is a file created during the installation of the IDE package distributed by the Eclipse Foundation," the AhnLab SEcurity Intelligence Center (ASEC) said . "It is a tool for signing JAR (Java Archive) files." The South Korean cybersecurity firm said the malware is propagated in the form of a compressed ZIP archive that includes the legitimate executable as well as the DLLs that are sideloaded to launch the malware - Documents2012.exe, a renamed version of the legitimate jarsigner.exe binary, jli.dll, a DLL file that's modified by the threat actor to decrypt and inject concrt140e.dll, and concrt140e.dll, the XLoader payload The attack chain crosses over to the malicious phase when "Documents2012.exe...

For decades, Microsoft Exchange has been the backbone of business communications, powering emailing, scheduling and collaboration for organizations worldwide. Whether deployed on-premises or in hybrid environments, companies of all sizes rely on Exchange for seamless internal and external communication, often integrating it deeply with their workflows, compliance policies and security frameworks. However, Microsoft has officially announced that support for Exchange Server 2016 and Exchange Server 2019 will end on October 14, 2025. While this may seem like a distant concern, businesses and IT teams must start preparing now. The end of support means that Microsoft will no longer provide security patches, bug fixes or technical support, leaving organizations running on these versions exposed to security vulnerabilities, compliance risks and potential operational disruptions. So, what should businesses do now? In this article, we’ll explore the impact of Microsoft’s decision, the risks...

Citrix has released security updates for a high-severity security flaw impacting NetScaler Console (formerly NetScaler ADM) and NetScaler Agent that could lead to privilege escalation under certain conditions. The vulnerability, tracked as CVE-2024-12284 , has been given a CVSS v4 score of 8.8 out of a maximum of 10.0. It has been described as a case of improper privilege management that could result in authenticated privilege escalation if the NetScaler Console Agent is deployed and allows an attacker to execute post-compromise actions. "The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization," Netscaler noted . "However, only authenticated users with existing access to the NetScaler Console can exploit this vulnerability, thereby limiting the threat surface to only authenticated users." The shortcoming affects the below versions - NetScaler Cons...