# Bring a tent, I've got the coffee: Lessons from it-sa > Source: > Published: 2026-11-05 19:00:00+00:00 Welcome to this week's edition of the Threat Source newsletter. I'm just back from an interesting and demanding week of booth duty at [__it-sa Expo&Congress__](https://www.itsa365.de/en/it-sa-expo-congress) in Nuremberg, where Talos had a Point of Demonstration at the Cisco booth. I personally see it-sa as the German or European counterpart to the RSA Conference in San Francisco, with a slightly different center of gravity in at least two dimensions. First, the expo is the main event, not the congress. The congress is organized by associations, industry groups, and exhibitors, and plays more of a supporting role. Second, the focus is more local and European. Major topics were (of course) AI for defense tooling, securing AI systems themselves, and post-quantum cryptography. And here comes the local touch (in my opinion): digital sovereignty and regulatory compliance, with NIS2, CRA, and DORA. But local doesn't translate to small, or to the city of Nuremberg. With more than 1,000 exhibitors and 33,000 visitors from 70 countries over three days of exhibition, preceded by a congress day, it was huge. Even as a trade show veteran, I was overwhelmed. My conversations at the booth had a different focus, though. It was a lot of chatter about vulnerabilities like [__php2shell__](https://blog.talosintelligence.com/two-critical-rces-in-php-core/) or [__broccoli2shell__](https://broccoli2shell.com/) and state-sponsored actors, but again with a local touch: education.   I was very surprised how many teenagers stopped by to ask for advice. Here in Germany, you mainly have two paths for your career. One is the university route, and the other is vocational (apprenticeship). Across all industries the split is roughly [__50__](https://www.destatis.de/DE/Presse/Pressemitteilungen/2025/11/PD25_426_21.html)/[__50__](https://www.bibb.de/de/1563.php), while in IT it is more like [__80%__](https://www.bitkom.org/sites/main/files/2026-09/bitkom-studienbericht-it-fachkraefte-2025.pdf) university, [__20%__](https://www.bibb.de/dokumente/pdf/naa309/naa309_2025_tab067_0bund.pdf) apprenticeship. The common minimum age to start university is 18, while it is 16 for apprenticeships. Reality is way more complex, but the details don’t matter for the point I want to make.  For university opportunities in cyber, I count close to 30 [__bachelor programs__](https://www.studieren-studium.com/studium/cyber-security). For apprenticeships, I count ZERO. There is the "IT Specialist" (Fachinformatiker), but it only has specializations like application development, system integration, digital networking, or data and process analysis. That is why an [__initiative__](https://www.eurobits.de/wp-content/uploads/Eurobits_Ausbildungsberuf_ITS_2025_Screen.pdf) exists to get an "IT Security" specialization going.  Even the degree route is thin. There are no official statistics, but my guess is 800 to 900 graduates a year, compared to a demand of more than 100,000. We need a second route into the field for the 16-year-old who finished various CTFs or Hack the Box challenges and wants to join the good side now. Honestly speaking, I would rather have them on our side of the fence at 16 than wonder at 26 where they ended up. How does it look in your country? On a personal note: If you consider visiting it-sa in 2027, book your accommodation early. The hotels are gone fast. That is the one downside, because Nuremberg isn't exactly a city with the infrastructure for more than 30,000 visitors. (Don't ask me how I learned that there are also camping spots close to the exhibition area.) See you in Nuremberg next year. Bring a tent, just in case. I've got the coffee. ## The one big thing [__Cisco Talos recently discovered VOLTA__](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/), a mature, self-deleting Windows infostealer that uses AI to act as a personal intelligence analyst for cybercriminals. After harvesting a massive haul of credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to a large language model to rank the victim’s assets by monetization value. The malware even uses stolen session access to enrich this data, searching the victim's emails for purchase receipts to corroborate home addresses. If an AI model refuses to perform the target assessment, VOLTA seamlessly fails over to a multi-model chain to ensure the attackers get their prioritized dossier.  ### Why do I care? VOLTA replaces the manual work of data sorting with automated, AI-driven victim profiling. By letting an LLM determine a target's worth, attackers drastically reduce the human effort required to monetize stolen data. This commoditized threat allows even low-level actors to bypass security measures like Chrome's App-Bound Encryption and receive ranked target assessments, escalating the risk of severe follow-on attacks. ### So now what? Organizations should implement application control policies to restrict or alert on processes launching Chrome with the `--headless` flag. Defenders must also enforce best practices for storing credentials in hardware-backed stores.   Revoke any potentially compromised tokens and change passwords. For cryptocurrency wallets, if the seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device. For more information and sample details, read the [__full blog__](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/).  ## Top security headlines of the week **AI agents used by Railway breach systems of rival Primcloud** This one is juicy. According to Primcloud’s founder, Railway’s agents used credentials from inside their own application’s containers to request every secret from Primcloud customers and employees and then twice port-scanned all 65,536 addresses on the company’s network. ([Security Boulevard](https://securityboulevard.com/2026/11/ai-agents-used-by-railway-breach-systems-of-rival-primcloud/)) ([X](https://x.com/joshmanders/status/2117458724407415295)) **Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries** A significant increase in freezer temperature has forced retailers to discard food in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden. Beyond supermarkets, cold storage for French plasma stock were affected, as well. ([__BBC__](https://www.bbc.com/news/articles/cwy8lm1m59mvo)) ([__The Register__](https://www.theregister.com/security/2026/11/04/cyberattack-on-french-plasma-stores-is-enough-to-make-your-blood-boil/5307519))  **Binance reveals how fake job interviews and AI tool abuse led to $6.43B theft**  Binance said the record-setting theft was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. ([__The Hacker News__](https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html))  **AI threats create urgent need to renew cybersecurity information-sharing law, businesses tell Congress**  After the law’s initial 10-year operating period expired in 2025, lawmakers passed several short-term extensions, with the latest one set to lapse on Dec. 11. Cybersecurity experts and industry leaders have repeatedly urged lawmakers to renew the law. ([__Cybersecurity Dive__](https://www.cybersecuritydive.com/news/cisa-2015-reauthorization-congress-ndaa-letter-businesses/873591/))  **Cops bust botnet of 1.3M infected Android TV boxes**  Security firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries. ([__The Register__](https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045))  ## Can’t get enough Talos? __The VOLTA infostealer: Outsourcing cybercrime grunt work to AI__ Ryan Fetterman breaks down the newly discovered infostealer. Unlike traditional stealers, VOLTA integrates LLMs to analyze stolen credentials in real-time, effectively turning raw data into a prioritized, high-value dossier for the attacker.  __Stealing AI secrets and breaking EDRs__ Phishing may have dropped from last quarter's highs, but ransomware engagements climbed as attackers shifted their focus toward disabling EDR systems and scraping AI credentials. The financial sector also returned as a top target.  __NIK C2: The new AI-enabled command-and-control framework__ NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session.  ## Upcoming events where you can find Talos - [__CYBERWARCON__](https://www.cyberwarcon.com/) (Nov. 20) Arlington, VA - [__AVAR 2026__](https://events.aavar.org/cybersecurity-conference/) (Dec. 2 – 4) Hyderabad, India - [__Black Hat Europe__](https://blackhat.com/europe/) (Dec. 7 – 10) London, U.K. - [__JSAC2027__](https://jsac.jpcert.or.jp/) (Jan. 19 – 22) Tokyo, Japan - [__Insomni’hack__](https://www.insomnihack.ch/) (Feb. 1 – 5) Lausanne, Switzerland ## Most prevalent malware files from Talos telemetry over the past week **SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507**  MD5: 2915b3f8b703eb744fc54c81f4a9c67f  Talos Rep: __https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507__ Example Filename: sample.exe  Detection Name: W32.9F1F11A708-100.SBX.TG  **SHA256: 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d**  MD5: 0cf0271c3564881fce95f44c649bd745  Talos Rep: __https://talosintelligence.com/talos_file_reputation?s=73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d__ Example Filename: KMSAuto++.exe  Detection Name: HackTool:WZTeam-tpd  **SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91**  MD5: 7bdbd180c081fa63ca94f9c22c457376  Talos Rep: __https://talosintelligence.com/talos_file_reputation?s=a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91__ Example Filename: d4aa3e7010220ad1b458fac17039c274_62_Exe.exe  Detection Name: Win.Dropper.Miner::95.sbx.tg**  **SHA256: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85**  MD5: 95a6a4b638cfdfbe3afc883d593a1f87  Talos Rep: [https://talosintelligence.com/talos_file_reputation?s=f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85](https://talosintelligence.com/talos_file_reputation?s=f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85)  Example Filename: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85.js  Detection Name: W32.F4B1F888F2-95.SBX.TG  **SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f**  MD5: cca616647db9370c88998ae25da6997f  Talos Rep: __https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f__ Example Filename: cca616647db9370c88998ae25da6997f.exe  Detection Name: Win.Tool.Kmsauto::1201