Threat video1:00
VOLTA-AUTODOXER Infostealer Ranks Loot: Detection & IOCs
VOLTA steals browser logins, wallet seeds and cloud keys, then an LLM ranks victims by value. Includes 9 detection rules, 17 IOCs and a free Splunk SPL rule.
Read the full threat intel for VOLTA-AUTODOXER Infostealer Ranks Loot: Detection & IOCs →
Chapters
- 0:00The hook17 techniques rank AI victim value.
- 0:04The storySteals credentials and wallets.
- 0:10Attack pathCustom binary auto-collects credentials and wallets.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise9 indicators to hunt: 1 SHA-256 hash, 7 file names and 1 path.
- 0:36MITRE ATT&CK techniques17 ATT&CK techniques, from stealth to exfiltration.
- 0:41Remediation4 steps now: Preserve %APPDATA%\volta_debug.txt from suspected hosts for investigation.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0017 techniques rank AI victim value.
0:05Steals credentials and wallets.
0:07AI ranks your value.
0:11Custom binary auto-collects credentials and wallets.
0:14Posts them to Claude Opus.
0:16It profiles victims for monetization.
0:19Exfils via Telegram, then self-deletes.
0:24No threat actor is attributed. Confidence: low.
0:299 indicators to hunt: 1 SHA-256 hash, 7 file names and 1 path.
0:3717 ATT&CK techniques, from stealth to exfiltration.
0:414 steps now: Preserve %APPDATA%\volta_debug.txt from suspected hosts for investigation.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.