Glenn Fryklund - Malwlab (Page 2)

AI/LLM Generated

Deep Dive Ransomware Analysis: 2025's Evolving Threat Landscape

The 2025 Ransomware Landscape: Record Claims, Fragmented Gangs, and What It Mean Article Type: Deep-dive analysis Target Audience: Security professionals, continuity planners, homelab and personal infrastructure operators Estimated Word Count: ~3,500 words Estimated Runtime: 12–15 min read Publish Channel: blog.malwlab.se Date: 2026-07-10 Introduction

AI/LLM Generated

Ollama on the Open Internet: 300,000 Exposed AI Inference Servers Under Active Attack

GreyNoise honeypot data reveals 300,000+ Ollama instances exposed to the internet. Bleeding Llama (CVE-2026-7482), LLMjacking campaigns, and agentic weaponization represent an escalating threat to homelab AI deployments.

Malware Analysis

LockBit 5.0: The Ransomware Resurgence Nobody Saw Coming

Executive Summary: Operation Cronos Failed to Kill It Operation Cronos was supposed to end LockBit. In February 2024, the FBI, UK's NCA, Europol, and agencies from eight other countries took down the group's infrastructure, seized its source code, arrested its ringleader Dmitry Khoroshev's alleged

Threat Intel

URGENT ADVISORY: ToolShell — Critical SharePoint RCE Chain Under Active Exploitation

URGENT: CVE-2025-53770/53771 ToolShell exploit chain under active exploitation since July 17, 2025. If you run on-prem SharePoint Server, you are vulnerable to unauthenticated RCE.