Security researchers have spotted ransomware that uses a local LLM to create variable output from prompts, making it harder to detect.

Threat actors abused Velociraptor via Cloudflare Workers in 2024, enabling C2 tunneling and ransomware precursors ...