Talos details VOLTA, a Windows infostealer that ranks loot with LLMs
Original title: Bring a tent, I've got the coffee: Lessons from it-sa
The same newsletter repeats claims about Railway agents, freezer attacks in 10 countries, and a Binance theft.
Cisco Talos's Threat Source newsletter recaps it-sa in Nuremberg and describes VOLTA, a self-deleting Windows infostealer. After collecting credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured bundle to a large language model to rank assets and fails over to other models if one refuses. Talos advises alerting on headless Chrome launches, revoking tokens, and treating plaintext wallet seeds as compromised. The roundup also repeats third-party claims about Railway agents, supermarket freezers, and Binance.
Unconfirmed: The Railway, freezer, and Binance items are repeated from other outlets or company claims, not Talos investigations.
- it-sa had more than 1,000 exhibitors and 33,000 visitors from 70 countries.
- VOLTA uses stolen sessions to search victim email for purchase receipts.
- Talos says VOLTA can bypass Chrome's App-Bound Encryption.
- Primcloud's founder alleges Railway agents requested customer and employee secrets.
- Binance attributes a $6.43B theft to fake interviews and a tampered Homebrew install.
Impact: Steals credentials, sessions, and cryptocurrency wallets
- 1.Restrict or alert on processes launching Chrome with the --headless flag.
- 2.Revoke potentially compromised tokens and change passwords.
- 3.If a wallet seed was plaintext on disk, move funds to a new wallet.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0cf0271c3564881fce95f44c649bd745 | 3260418c2271b863c567e40e842adbab3c57023cb72de590ea377d MD5: 0cf0271c3564881fce95f44c649bd745 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 7bdbd180c081fa63ca94f9c22c457376 | 83227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 95a6a4b638cfdfbe3afc883d593a1f87 | 9faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 MD5: 95a6a4b638cfdfbe3afc883d593a1f87 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | cca616647db9370c88998ae25da6997f | 6bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| sha256 | 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d | ample.exe Detection Name: W32.9F1F11A708-100.SBX.TG SHA256: 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d MD5: 0cf0271c3564881fce95f44c649bd745 Talos Rep: https://ta |
| sha256 | 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f | c81df85.js Detection Name: W32.F4B1F888F2-95.SBX.TG SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://ta |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta |
| sha256 | a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 | : KMSAuto++.exe Detection Name: HackTool:WZTeam-tpd SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Talos Rep: https://ta |
| sha256 | f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 | .exe Detection Name: Win.Dropper.Miner::95.sbx.tg** SHA256: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 MD5: 95a6a4b638cfdfbe3afc883d593a1f87 Talos Rep: https://ta |
From the original article
6 min read at blog.talosintelligence.com
Thorsten may have had to camp out in Nuremberg to attend it-sa, but the real story is the initiative to add a formal IT Security apprenticeship program in Germany for the thousands of young hackers ready to join our side.
By Thorsten Rosendahl · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.