{"slug": "bring-a-tent-i-ve-got-the-coffee-lessons-from-it-sa", "title": "Bring a tent, I've got the coffee: Lessons from it-sa", "summary": "Cisco Talos discovered VOLTA, a mature, self-deleting Windows infostealer that uses AI to prioritize victims for cybercriminals, the security firm reported. The disclosure came as Talos staffed a booth at it-sa Expo&Congress in Nuremberg, which drew more than 1,000 exhibitors and 33,000 visitors from 70 countries over three exhibition days plus a congress day, with AI for defense tooling, securing AI systems, post-quantum cryptography, digital sovereignty and NIS2, CRA and DORA compliance as major topics. Talos also flagged a cybersecurity education gap in Germany: close to 30 bachelor's programs in cyber security exist versus zero apprenticeships, with an estimated 800 to 900 graduates a year against demand of more than 100,000.", "body_md": "Welcome to this week's edition of the Threat Source newsletter.\n\nI'm just back from an interesting and demanding week of booth duty at [__it-sa Expo&Congress__](https://www.itsa365.de/en/it-sa-expo-congress) in Nuremberg, where Talos had a Point of Demonstration at the Cisco booth.\n\nI personally see it-sa as the German or European counterpart to the RSA Conference in San Francisco, with a slightly different center of gravity in at least two dimensions.\n\nFirst, the expo is the main event, not the congress. The congress is organized by associations, industry groups, and exhibitors, and plays more of a supporting role. Second, the focus is more local and European. Major topics were (of course) AI for defense tooling, securing AI systems themselves, and post-quantum cryptography. And here comes the local touch (in my opinion): digital sovereignty and regulatory compliance, with NIS2, CRA, and DORA.\n\nBut local doesn't translate to small, or to the city of Nuremberg. With more than 1,000 exhibitors and 33,000 visitors from 70 countries over three days of exhibition, preceded by a congress day, it was huge. Even as a trade show veteran, I was overwhelmed.\n\nMy conversations at the booth had a different focus, though. It was a lot of chatter about vulnerabilities like [__php2shell__](https://blog.talosintelligence.com/two-critical-rces-in-php-core/) or [__broccoli2shell__](https://broccoli2shell.com/) and state-sponsored actors, but again with a local touch: education.  \n\nI was very surprised how many teenagers stopped by to ask for advice. Here in Germany, you mainly have two paths for your career. One is the university route, and the other is vocational (apprenticeship). Across all industries the split is roughly [__50__](https://www.destatis.de/DE/Presse/Pressemitteilungen/2025/11/PD25_426_21.html)/[__50__](https://www.bibb.de/de/1563.php), while in IT it is more like [__80%__](https://www.bitkom.org/sites/main/files/2026-09/bitkom-studienbericht-it-fachkraefte-2025.pdf) university, [__20%__](https://www.bibb.de/dokumente/pdf/naa309/naa309_2025_tab067_0bund.pdf) apprenticeship. The common minimum age to start university is 18, while it is 16 for apprenticeships. Reality is way more complex, but the details don’t matter for the point I want to make. \n\nFor university opportunities in cyber, I count close to 30 [__bachelor programs__](https://www.studieren-studium.com/studium/cyber-security). For apprenticeships, I count ZERO. There is the \"IT Specialist\" (Fachinformatiker), but it only has specializations like application development, system integration, digital networking, or data and process analysis. That is why an [__initiative__](https://www.eurobits.de/wp-content/uploads/Eurobits_Ausbildungsberuf_ITS_2025_Screen.pdf) exists to get an \"IT Security\" specialization going. \n\nEven the degree route is thin. There are no official statistics, but my guess is 800 to 900 graduates a year, compared to a demand of more than 100,000. We need a second route into the field for the 16-year-old who finished various CTFs or Hack the Box challenges and wants to join the good side now. Honestly speaking, I would rather have them on our side of the fence at 16 than wonder at 26 where they ended up.\n\nHow does it look in your country?\n\nOn a personal note: If you consider visiting it-sa in 2027, book your accommodation early. The hotels are gone fast. That is the one downside, because Nuremberg isn't exactly a city with the infrastructure for more than 30,000 visitors. (Don't ask me how I learned that there are also camping spots close to the exhibition area.)\n\nSee you in Nuremberg next year. Bring a tent, just in case. I've got the coffee.\n\n## The one big thing\n\n[__Cisco Talos recently discovered VOLTA__](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/), a mature, self-deleting Windows infostealer that uses AI to act as a personal intelligence analyst for cybercriminals. After harvesting a massive haul of credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to a large language model to rank the victim’s assets by monetization value. The malware even uses stolen session access to enrich this data, searching the victim's emails for purchase receipts to corroborate home addresses. If an AI model refuses to perform the target assessment, VOLTA seamlessly fails over to a multi-model chain to ensure the attackers get their prioritized dossier. \n\n### Why do I care?\n\nVOLTA replaces the manual work of data sorting with automated, AI-driven victim profiling. By letting an LLM determine a target's worth, attackers drastically reduce the human effort required to monetize stolen data. This commoditized threat allows even low-level actors to bypass security measures like Chrome's App-Bound Encryption and receive ranked target assessments, escalating the risk of severe follow-on attacks.\n\n### So now what?\n\nOrganizations should implement application control policies to restrict or alert on processes launching Chrome with the `--headless` flag. Defenders must also enforce best practices for storing credentials in hardware-backed stores.  \n\nRevoke any potentially compromised tokens and change passwords. For cryptocurrency wallets, if the seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device. For more information and sample details, read the [__full blog__](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/). \n\n## Top security headlines of the week\n\n**AI agents used by Railway breach systems of rival Primcloud**\n\nThis one is juicy. According to Primcloud’s founder, Railway’s agents used credentials from inside their own application’s containers to request every secret from Primcloud customers and employees and then twice port-scanned all 65,536 addresses on the company’s network. ([Security Boulevard](https://securityboulevard.com/2026/11/ai-agents-used-by-railway-breach-systems-of-rival-primcloud/)) ([X](https://x.com/joshmanders/status/2117458724407415295))\n\n**Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries**\n\nA significant increase in freezer temperature has forced retailers to discard food in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden. Beyond supermarkets, cold storage for French plasma stock were affected, as well. ([__BBC__](https://www.bbc.com/news/articles/cwy8lm1m59mvo)) ([__The Register__](https://www.theregister.com/security/2026/11/04/cyberattack-on-french-plasma-stores-is-enough-to-make-your-blood-boil/5307519)) \n\n**Binance reveals how fake job interviews and AI tool abuse led to $6.43B theft** \n\nBinance said the record-setting theft was the culmination of a \"sophisticated, multi-stage campaign\" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. ([__The Hacker News__](https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html)) \n\n**AI threats create urgent need to renew cybersecurity information-sharing law, businesses tell Congress** \n\nAfter the law’s initial 10-year operating period expired in 2025, lawmakers passed several short-term extensions, with the latest one set to lapse on Dec. 11. Cybersecurity experts and industry leaders have repeatedly urged lawmakers to renew the law. ([__Cybersecurity Dive__](https://www.cybersecuritydive.com/news/cisa-2015-reauthorization-congress-ndaa-letter-businesses/873591/)) \n\n**Cops bust botnet of 1.3M infected Android TV boxes** \n\nSecurity firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries. ([__The Register__](https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045)) \n\n## Can’t get enough Talos?\n\n__The VOLTA infostealer: Outsourcing cybercrime grunt work to AI__\n\nRyan Fetterman breaks down the newly discovered infostealer. Unlike traditional stealers, VOLTA integrates LLMs to analyze stolen credentials in real-time, effectively turning raw data into a prioritized, high-value dossier for the attacker. \n\n__Stealing AI secrets and breaking EDRs__\n\nPhishing may have dropped from last quarter's highs, but ransomware engagements climbed as attackers shifted their focus toward disabling EDR systems and scraping AI credentials. The financial sector also returned as a top target. \n\n__NIK C2: The new AI-enabled command-and-control framework__\n\nNIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. \n\n## Upcoming events where you can find Talos\n\n- [__CYBERWARCON__](https://www.cyberwarcon.com/) (Nov. 20) Arlington, VA\n- [__AVAR 2026__](https://events.aavar.org/cybersecurity-conference/) (Dec. 2 – 4) Hyderabad, India\n- [__Black Hat Europe__](https://blackhat.com/europe/) (Dec. 7 – 10) London, U.K.\n- [__JSAC2027__](https://jsac.jpcert.or.jp/) (Jan. 19 – 22) Tokyo, Japan\n- [__Insomni’hack__](https://www.insomnihack.ch/) (Feb. 1 – 5) Lausanne, Switzerland\n\n## Most prevalent malware files from Talos telemetry over the past week\n\n**SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507** \n\nMD5: 2915b3f8b703eb744fc54c81f4a9c67f \n\nTalos Rep: __https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507__\n\nExample Filename: sample.exe \n\nDetection Name: W32.9F1F11A708-100.SBX.TG \n\n**SHA256: 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d** \n\nMD5: 0cf0271c3564881fce95f44c649bd745 \n\nTalos Rep: __https://talosintelligence.com/talos_file_reputation?s=73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d__\n\nExample Filename: KMSAuto++.exe \n\nDetection Name: HackTool:WZTeam-tpd \n\n**SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91** \n\nMD5: 7bdbd180c081fa63ca94f9c22c457376 \n\nTalos Rep: __https://talosintelligence.com/talos_file_reputation?s=a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91__\n\nExample Filename: d4aa3e7010220ad1b458fac17039c274_62_Exe.exe \n\nDetection Name: Win.Dropper.Miner::95.sbx.tg** \n\n**SHA256: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85** \n\nMD5: 95a6a4b638cfdfbe3afc883d593a1f87 \n\nTalos Rep: [https://talosintelligence.com/talos_file_reputation?s=f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85](https://talosintelligence.com/talos_file_reputation?s=f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85) \n\nExample Filename: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85.js \n\nDetection Name: W32.F4B1F888F2-95.SBX.TG \n\n**SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f** \n\nMD5: cca616647db9370c88998ae25da6997f \n\nTalos Rep: __https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f__\n\nExample Filename: cca616647db9370c88998ae25da6997f.exe \n\nDetection Name: Win.Tool.Kmsauto::1201", "url": "https://wpnews.pro/news/bring-a-tent-i-ve-got-the-coffee-lessons-from-it-sa", "canonical_source": "https://blog.talosintelligence.com/bring-a-tent-ive-got-the-coffee-lessons-from-it-sa/", "published_at": "2026-11-05 19:00:00+00:00", "updated_at": "2026-11-05 19:20:26.077392+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-policy"], "entities": ["Cisco Talos", "VOLTA", "it-sa Expo&Congress", "Nuremberg", "Cisco", "NIS2", "CRA", "DORA"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/bring-a-tent-i-ve-got-the-coffee-lessons-from-it-sa", "markdown": "https://wpnews.pro/news/bring-a-tent-i-ve-got-the-coffee-lessons-from-it-sa.md", "text": "https://wpnews.pro/news/bring-a-tent-i-ve-got-the-coffee-lessons-from-it-sa.txt", "jsonld": "https://wpnews.pro/news/bring-a-tent-i-ve-got-the-coffee-lessons-from-it-sa.jsonld"}}