cyber.hendryadrian.com
Security News · securityweek.com

Cybersecurity Roundup: n8n Exploitation, Slopoly Malware and Interpol Crackdown

· Original article ↗

Summary

This roundup covers Google Cloud threat findings, n8n exploitation, Linux and Veeam vulnerabilities, a Telus Digital incident, Slopoly malware research, and an Interpol operation that dismantled more than 45,000 malicious IP addresses and servers.

Key points

  • Google’s Cloud Threat Horizons Report, based on data from the second half of 2025, says vulnerability exploitation overtook weak credentials for initial access, with attacks following disclosures in days rather than weeks.
  • Polish investigators identified seven minors accused of distributing DDoS tools; US prosecutors charged a third alleged BlackCat/ALPHV ransomware negotiator.
  • L3Harris is believed to have developed some Coruna iOS exploits that reportedly reached Russian actors; Apple updated older iOS versions to address the exploits.
  • Telus Digital confirmed a cybersecurity incident after ShinyHunters claimed to have stolen around 1 petabyte of data. Telus said it is investigating; the data involved and access method were not disclosed.
  • CISA added n8n flaw CVE-2025-68613, which allows remote code execution, to its Known Exploited Vulnerabilities catalog; public details about the attacks are lacking. Veeam also disclosed critical and high-severity product flaws, with no in-the-wild exploitation evidence reported.
  • Qualys disclosed nine CrackArmor vulnerabilities that could let an unprivileged local user gain root access on Linux systems. Interpol’s Operation Synergia III dismantled more than 45,000 malicious IP addresses and servers and led to 94 arrests.
  • IBM researchers found Slopoly malware, which they believe was likely AI-generated, used in later stages of an attack by financially motivated group Hive0163, known for using Interlock ransomware.

Article Details

Event Type
Cybersecurity news roundup covering vulnerability exploitation, malware, a reported data breach, and law-enforcement actions
Impact
The roundup reports active exploitation of the n8n vulnerability CVE-2025-68613, which enables remote code execution, and nine CrackArmor flaws that could let an unprivileged local user gain root access on affected Linux systems. Telus Digital confirmed a cybersecurity incident after ShinyHunters claimed to have stolen around 1 petabyte of data; the company said it was investigating and provided no further details. Other reported developments include Slopoly malware used in an attack by Hive0163, a global operation that dismantled more than 45,000 malicious IP addresses and servers, and exploit-related disclosures involving Coruna and older iOS versions.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe CrackArmor flaws could allow an unprivileged local user to exploit the vulnerabilities to escalate privileges and gain root access.

CVE

CVE-2025-68613n8n-io · n8nThe flaw, tracked as CVE-2025-68613, allows remote code execution.

People

Angelo MartinoThe article reports that US prosecutors charged him with acting as a negotiator for the BlackCat/Alphv ransomware gang; it says he worked as a ransomware negotiator for DigitalMint.

Threat Actors

ALPHVThe article identifies BlackCat/Alphv as a ransomware gang whose negotiator was charged by US prosecutors.BlackCatThe article identifies BlackCat/Alphv as a ransomware gang whose negotiator was charged by US prosecutors.Hive0163The article describes Hive0163 as a financially motivated cybercrime group and reports that Slopoly malware was used in the later stages of one of its attacks.ShinyHuntersThe article says ShinyHunters claimed to have stolen around 1 petabyte of information from Telus Digital; the claim is attributed to the group, and the article does not confirm the amount or exact data involved.

Malware

InterlockThe malware was used in the later stages of an attack by a financially motivated cybercrime group named Hive0163, which is known for the use of the Interlock ransomware.SlopolyAI-generated Slopoly malware found by IBM

Vendors

AppleApple this week updated older iOS versions to address the Coruna exploits.L3HarrisUS military contractor L3Harris is believed to have developed at least some of the Coruna iOS exploits.VeeamCritical Veeam product vulnerabilities

Products

AppArmorNew CrackArmor vulnerabilities in Linux AppArmor allow root privilegesiOSUS military contractor L3Harris is believed to have developed at least some of the Coruna iOS exploits.n8nN8n vulnerability exploited

Countries

RussiaThe exploit leak may be related to the case of a former executive at L3Harris division Trenchant, who was recently jailed for selling Android and iOS exploits to Russia.United StatesUS military contractor L3Harris is believed to have developed at least some of the Coruna iOS exploits.

Industries

CybersecuritySecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape.DefenseUS defense contractor suspected of creating Coruna exploitsLaw enforcementAn international law enforcement effort coordinated by Interpol dismantled more than 45,000 malicious IP addresses and servers used for phishing, malware, ransomware, and online fraud campaigns.

Related Articles