conv.

← The whole story
Security
Malware VOLTA uses LLMs to rank victims by financial worth

VOLTA sends stolen data to OpenRouter for LLM-powered victim assessment

1 Oct 31 8:00 AM · 11d ago · 1 post · 1 source · development 1 of 2

The malware serializes the stolen bundle and POSTs it to OpenRouter under a system prompt instructing the model to act as a forensic intelligence analyst. The LLM generates a structured dossier with sections titled 'WHAT THEY'RE WORTH' (valuables ranked by monetization tier) and 'THEIR OPSEC' (security posture assessment). The malware uses a multi-model fallback architecture with up to three models, with low temperature settings (0.2) for consistency and checks for refusal phrases like 'I can't' or 'I'm not able.'

VOLTA sends stolen data to OpenRouter for LLM-powered victim assessment
blog.talosintelligence.com

“The model is the operator's triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.”

Cisco Talos Intelligence

Cisco Talos Intelligence Malware researcherCAIRN research effort Research collaborationOpenRouter LLM API service

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 12 pieces in 3h at Oct 31, 10 AM; 28 pieces over 12 days (3 articles · 3 posts · 22 comments) Oct 31, 7 AM — 4 pieces · 3 articles · 1 post — Newswires 2, Mastodon 1, Hacker News 1Oct 31, 10 AM — 12 pieces · 2 posts · 10 comments — Hacker News 10, Mastodon 2Oct 31, 1 PM — 8 pieces · 8 comments — Hacker News 8Oct 31, 4 PM — 1 piece · 1 comment — Hacker News 1Oct 31, 7 PM — quietOct 31, 10 PM — 2 pieces · 2 comments — Hacker News 2Nov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — 1 piece · 1 comment — Hacker News 1Nov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quietToday, 9 PM — quiet 1–2
1–2VOLTA sends stolen data to OpenRouter for…
Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 11:36 PM ET

What was reported 2 claims about this development

  1. 2 outlets Malware uses LLMs to rank victims by how much they're worth

    first by HN Best, 11d ago · also HN Frontpage

  2. 1 outlet Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

    first by Mastodon, 11d ago

All 2 developments of Malware VOLTA uses LLMs to rank victims by financial worth →

Hacker NewsNewswiresMastodon