Welcome to this week's edition of the Threat Source newsletter. 

I'm just back from an interesting and demanding week of booth duty at it-sa Expo&Congress in Nuremberg, where Talos had a Point of Demonstration at the Cisco booth.

I personally see it-sa as the German or European counterpart to the RSA Conference in San Francisco, with a slightly different center of gravity in at least two dimensions. 

First, the expo is the main event, not the congress. The congress is organized by associations, industry groups, and exhibitors, and plays more of a supporting role. Second, the focus is more local and European. Major topics were (of course) AI for defense tooling, securing AI systems themselves, and post-quantum cryptography. And here comes the local touch (in my opinion): digital sovereignty and regulatory compliance, with NIS2, CRA, and DORA. 

But local doesn't translate to small, or to the city of Nuremberg. With more than 1,000 exhibitors and 33,000 visitors from 70 countries over three days of exhibition, preceded by a congress day, it was huge. Even as a trade show veteran, I was overwhelmed. 

My conversations at the booth had a different focus, though. It was a lot of chatter about vulnerabilities like php2shell or broccoli2shell and state-sponsored actors, but again with a local touch: education.  

I was very surprised how many teenagers stopped by to ask for advice. Here in Germany, you mainly have two paths for your career. One is the university route, and the other is vocational (apprenticeship). Across all industries the split is roughly 50/50, while in IT it is more like 80% university, 20% apprenticeship. The common minimum age to start university is 18, while it is 16 for apprenticeships. Reality is way more complex, but the details don’t matter for the point I want to make. 

For university opportunities in cyber, I count close to 30 bachelor programs. For apprenticeships, I count ZERO. There is the "IT Specialist" (Fachinformatiker), but it only has specializations like application development, system integration, digital networking, or data and process analysis. That is why an initiative exists to get an "IT Security" specialization going. 

Even the degree route is thin. There are no official statistics, but my guess is 800 to 900 graduates a year, compared to a demand of more than 100,000. We need a second route into the field for the 16-year-old who finished various CTFs or Hack the Box challenges and wants to join the good side now. Honestly speaking, I would rather have them on our side of the fence at 16 than wonder at 26 where they ended up. 

How does it look in your country? 

On a personal note: If you consider visiting it-sa in 2027, book your accommodation early. The hotels are gone fast. That is the one downside, because Nuremberg isn't exactly a city with the infrastructure for more than 30,000 visitors. (Don't ask me how I learned that there are also camping spots close to the exhibition area.)

See you in Nuremberg next year. Bring a tent, just in case. I've got the coffee.

The one big thing  

Cisco Talos recently discovered VOLTA, a mature, self-deleting Windows infostealer that uses AI to act as a personal intelligence analyst for cybercriminals. After harvesting a massive haul of credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to a large language model to rank the victim’s assets by monetization value. The malware even uses stolen session access to enrich this data, searching the victim's emails for purchase receipts to corroborate home addresses. If an AI model refuses to perform the target assessment, VOLTA seamlessly fails over to a multi-model chain to ensure the attackers get their prioritized dossier. 

Why do I care? 

VOLTA replaces the manual work of data sorting with automated, AI-driven victim profiling. By letting an LLM determine a target's worth, attackers drastically reduce the human effort required to monetize stolen data. This commoditized threat allows even low-level actors to bypass security measures like Chrome's App-Bound Encryption and receive ranked target assessments, escalating the risk of severe follow-on attacks. 

So now what? 

Organizations should implement application control policies to restrict or alert on processes launching Chrome with the --headless flag. Defenders must also enforce best practices for storing credentials in hardware-backed stores.  

Revoke any potentially compromised tokens and change passwords. For cryptocurrency wallets, if the seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device. For more information and sample details, read the full blog. 

Top security headlines of the week 

AI agents used by Railway breach systems of rival Primcloud
This one is juicy. According to Primcloud’s founder, Railway’s agents used credentials from inside their own application’s containers to request every secret from Primcloud customers and employees and then twice port-scanned all 65,536 addresses on the company’s network. (Security Boulevard) (X)

Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries
A significant increase in freezer temperature has forced retailers to discard food in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden. Beyond supermarkets, cold storage for French plasma stock were affected, as well. (BBC) (The Register) 

Binance reveals how fake job interviews and AI tool abuse led to $6.43B theft 
Binance said the record-setting theft was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. (The Hacker News) 

AI threats create urgent need to renew cybersecurity information-sharing law, businesses tell Congress 
After the law’s initial 10-year operating period expired in 2025, lawmakers passed several short-term extensions, with the latest one set to lapse on Dec. 11. Cybersecurity experts and industry leaders have repeatedly urged lawmakers to renew the law. (Cybersecurity Dive) 

Cops bust botnet of 1.3M infected Android TV boxes 
Security firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries. (The Register) 

Can’t get enough Talos? 

The VOLTA infostealer: Outsourcing cybercrime grunt work to AI 
Ryan Fetterman breaks down the newly discovered infostealer. Unlike traditional stealers, VOLTA integrates LLMs to analyze stolen credentials in real-time, effectively turning raw data into a prioritized, high-value dossier for the attacker. 

Stealing AI secrets and breaking EDRs 
Phishing may have dropped from last quarter's highs, but ransomware engagements climbed as attackers shifted their focus toward disabling EDR systems and scraping AI credentials. The financial sector also returned as a top target. 

NIK C2: The new AI-enabled command-and-control framework 
NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. 

Upcoming events where you can find Talos 

Most prevalent malware files from Talos telemetry over the past week  

SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
Example Filename: sample.exe 
Detection Name: W32.9F1F11A708-100.SBX.TG 

SHA256: 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d 
MD5: 0cf0271c3564881fce95f44c649bd745 
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d 
Example Filename: KMSAuto++.exe 
Detection Name: HackTool:WZTeam-tpd 

SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 
MD5: 7bdbd180c081fa63ca94f9c22c457376 
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 
Example Filename: d4aa3e7010220ad1b458fac17039c274_62_Exe.exe 
Detection Name: Win.Dropper.Miner::95.sbx.tg** 

SHA256: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 
MD5: 95a6a4b638cfdfbe3afc883d593a1f87 
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 
Example Filename: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85.js 
Detection Name: W32.F4B1F888F2-95.SBX.TG 

SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f 
MD5: cca616647db9370c88998ae25da6997f 
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f 
Example Filename: cca616647db9370c88998ae25da6997f.exe 
Detection Name: Win.Tool.Kmsauto::1201