{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "VOLTA uses AI to automate the analysis of stolen data, drastically increasing the attacker's monetization speed. Detecting this post-harvest phase allows us to identify the full scope of a breach beyond simple credential theft." }, "name": "Cloud Service Enrichment and AI Assessment", "type": "investigation", "labels": [ "hunt", "attack.t1041", "attack.t1555", "attack.t1539", "attack.t1114.002", "attack.t1005", "collection", "credential access", "execution", "exfiltration" ], "series": { "slug": "appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer", "index": 2, "title": "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer", "total": 2 }, "related": [ { "hunt": "volta-stealer-core-harvesting", "reason": "The harvesting of credentials and session tokens precedes the enrichment and AI triage phase covered here.", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule might catch OpenRouter DNS, but this hunt correlates it with specific third-party service lookups (Roblox, DoorDash) and the presence of locally staged evidence files, providing the context needed to confirm a mature infostealer operation.", "coverage": [ { "stage": "session-driven-enrichment", "steps": [ "dns-leads-to-enrichment", "file-artifact-creation" ], "status": "covered" }, { "stage": "ai-triage-and-assessment", "steps": [ "http-api-triage-requests", "file-artifact-creation" ], "status": "covered" }, { "stage": "malware-execution-and-logging", "reason": "Belongs to another part of the 'Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer' series.", "status": "out_of_scope" }, { "stage": "credential-harvesting-and-abe-bypass", "reason": "Belongs to another part of the 'Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer' series.", "status": "out_of_scope" }, { "stage": "exfiltration-and-self-deletion", "reason": "Belongs to another part of the 'Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Malware execution and logging", "slug": "malware-execution-and-logging", "tactic": "execution", "techniques": [ "T1204.002" ], "observables": [ "9BY0tjwOc3ut.exe", "yLP9m5J3i2Aw.exe", "%APPDATA%\\volta_debug.txt" ] }, { "name": "Credential harvesting and ABE bypass", "slug": "credential-harvesting-and-abe-bypass", "tactic": "credential-access", "techniques": [ "T1555", "T1555.003" ], "observables": [ "chrome.exe --headless", "WlanGetProfileList", "Identity_Report.txt" ] }, { "name": "Session-driven enrichment", "slug": "session-driven-enrichment", "tactic": "collection", "techniques": [ "T1539", "T1114.002" ], "observables": [ "rolimons.com", "battle.net", "hide.me", "order history requests to DoorDash/UberEats", "Gmail API queries for receipts" ] }, { "name": "AI triage and assessment", "slug": "ai-triage-and-assessment", "tactic": "collection", "techniques": [ "T1005" ], "observables": [ "openrouter.ai/api/v1/chat/completions", "AI_Analysis.txt", "system prompt: forensic intelligence analyst drafting a target assessment" ] }, { "name": "Exfiltration and self-deletion", "slug": "exfiltration-and-self-deletion", "tactic": "exfiltration", "techniques": [ "T1041", "T1070.004" ], "observables": [ "volta_dox.zip", "deletion of 9BY0tjwOc3ut.exe" ] } ], "summary": "VOLTA is a Windows infostealer that automates post-compromise victim prioritization using Large Language Models. After harvesting credentials and personal data\u2014enriched via stolen sessions for services like Gmail and UberEats\u2014it POSTs a structured bundle to the OpenRouter API to generate a monetization dossier before exfiltrating the results and self-deleting." }, "severity": "high", "rationale": "Focus on developer workstations and high-value user profiles where cloud tokens (Gmail, Slack) are likely to be present. Use the DNS lead query to identify candidates for the full HTTP and File inspection via the scope_hosts parameter.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is using stolen session tokens to query third-party APIs for victim data enrichment and calling LLMs to prioritize assets for exfiltration.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-10-31" }, "type": "list[host]", "default": [], "description": "Target hosts to narrow the hunt; populate with results from the DNS scoping step." }, "report_files": { "from": { "ref": "talos-volta-ai", "kind": "article", "observed": "2026-10-31" }, "type": "list[path]", "default": [ "Identity_Report.txt", "AI_Analysis.txt", "volta_dox.zip" ], "description": "Local artifacts generated during the enrichment and AI triage phase." }, "lookback_days": { "from": { "ref": "retention-policy", "kind": "manual", "observed": "2026-10-31" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "enrichment_domains": { "from": { "ref": "talos-volta-ai", "kind": "article", "observed": "2026-10-31" }, "type": "list[domain]", "default": [ "openrouter.ai", "rolimons.com", "battle.net", "hide.me", "ubereats.com", "doordash.com", "grubhub.com" ], "description": "Domains used by VOLTA for victim enrichment and AI assessment." }, "volta_process_names": { "from": { "ref": "talos-sample-details", "kind": "article", "observed": "2026-10-31" }, "type": "list[string]", "default": [ "9BY0tjwOc3ut.exe", "yLP9m5J3i2Aw.exe" ], "description": "Process names identified as responsible for enrichment DNS lookups." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/", "name": "Talos \u2014 Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer" } ], "blind_spots": [ { "id": "no-http-transparency", "risk": "If HTTP inspection is missing, we only see DNS for OpenRouter, which is common for developer AI usage, leading to false negatives.", "stage": "ai-triage-and-assessment", "question": "whether the POST request to OpenRouter occurred and what it contained", "requires": "hb_http_activity or decrypted proxy logs" }, { "id": "self-deletion-evasion", "risk": "The malware is self-deleting; if snapshot-based file collection misses the creation window, the primary file indicator is lost.", "stage": "ai-triage-and-assessment", "question": "whether Identity_Report.txt was created and then immediately removed", "requires": "hb_file_activity real-time event streaming" } ] }, "name": "Cloud Service Enrichment and AI Assessment", "description": "This hunt identifies the post-collection behavior of the VOLTA infostealer, where it uses harvested sessions to profile victims and uses AI for asset triage. After harvesting credentials, the malware queries services like Gmail, DoorDash, and Roblox to enrich a victim dossier. It then POSTs this bundle to OpenRouter (an AI aggregator) to rank the monetization value. We hunt for this by correlating DNS lookups for enrichment domains with specific HTTP POSTs to AI providers and the creation of local report artifacts like Identity_Report.txt." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer", "index": 2, "title": "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer", "total": 2 }, "coverage": [ { "stage": "session-driven-enrichment", "steps": [ "dns-leads-to-enrichment", "file-artifact-creation" ], "status": "covered" }, { "stage": "ai-triage-and-assessment", "steps": [ "http-api-triage-requests", "file-artifact-creation" ], "status": "covered" }, { "stage": "malware-execution-and-logging", "reason": "Belongs to another part of the 'Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer' series.", "status": "out_of_scope" }, { "stage": "credential-harvesting-and-abe-bypass", "reason": "Belongs to another part of the 'Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer' series.", "status": "out_of_scope" }, { "stage": "exfiltration-and-self-deletion", "reason": "Belongs to another part of the 'Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer' series.", "status": "out_of_scope" } ], "rationale": "An intruder is using stolen session tokens to query third-party APIs for victim data enrichment and calling LLMs to prioritize assets for exfiltration.", "blind_spots": [ { "id": "no-http-transparency", "risk": "If HTTP inspection is missing, we only see DNS for OpenRouter, which is common for developer AI usage, leading to false negatives.", "stage": "ai-triage-and-assessment", "question": "whether the POST request to OpenRouter occurred and what it contained", "requires": "hb_http_activity or decrypted proxy logs" }, { "id": "self-deletion-evasion", "risk": "The malware is self-deleting; if snapshot-based file collection misses the creation window, the primary file indicator is lost.", "stage": "ai-triage-and-assessment", "question": "whether Identity_Report.txt was created and then immediately removed", "requires": "hb_file_activity real-time event streaming" } ], "scoping_notes": "Focus on developer workstations and high-value user profiles where cloud tokens (Gmail, Slack) are likely to be present. Use the DNS lead query to identify candidates for the full HTTP and File inspection via the scope_hosts parameter.", "beyond_detection": "A simple rule might catch OpenRouter DNS, but this hunt correlates it with specific third-party service lookups (Roblox, DoorDash) and the presence of locally staged evidence files, providing the context needed to confirm a mature infostealer operation." } }, { "id": "dns-leads-to-enrichment", "type": "query", "label": "DNS resolutions for enrichment and AI services", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{enrichment_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, query_hostname", "surface": "hb_dns_activity", "description": "Identify hosts resolving domains associated with session-based enrichment or AI prioritization as a starting lead.", "expected_signal": "Rare resolutions for OpenRouter or niche food/gaming domains indicate potential enrichment activity. Silence suggests no such lookups occurred." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "DNS resolutions for enrichment and AI services", "reads": [ "device_hostname", "process_name", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{enrichment_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, query_hostname", "silence": "evidence_of_absence", "expected": "Rare resolutions for OpenRouter or niche food/gaming domains indicate potential enrichment activity. Silence suggests no such lookups occurred.", "verified": "dry-run", "verified_at": "2026-11-01" } }, { "id": "http-api-triage-requests", "type": "query", "label": "HTTP POSTs to enrichment and AI APIs", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_hostname, url_path, http_method, user_agent, time FROM hb_http_activity WHERE instr(',' || '{{enrichment_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND http_method = 'POST' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Detect specific API calls that send the victim dossier for assessment or query third-party enrichment services.", "expected_signal": "POST requests to OpenRouter or enrichment endpoints, specifically from hosts identified in the scoping step." }, "parents": [ { "id": "dns-leads-to-enrichment" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "HTTP POSTs to enrichment and AI APIs", "reads": [ "device_hostname", "http_method", "src_endpoint_ip", "time", "url_hostname", "url_path", "user_agent" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_hostname, url_path, http_method, user_agent, time FROM hb_http_activity WHERE instr(',' || '{{enrichment_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND http_method = 'POST' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "POST requests to OpenRouter or enrichment endpoints, specifically from hosts identified in the scoping step.", "verified": "dry-run", "verified_at": "2026-11-01" } }, { "id": "file-artifact-creation", "type": "query", "label": "Creation of Identity and AI analysis reports", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 1 AND (instr(',' || '{{report_files}}' || ',', ',' || file_name || ',') > 0 OR instr(',' || '{{volta_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find the local evidence bundles and AI dossiers created before exfiltration, including activity from processes linked to enrichment lookups.", "expected_signal": "The presence of files named Identity_Report.txt or AI_Analysis.txt, or files created by known VOLTA processes." }, "parents": [ { "id": "dns-leads-to-enrichment" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Creation of Identity and AI analysis reports", "reads": [ "activity_id", "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 1 AND (instr(',' || '{{report_files}}' || ',', ',' || file_name || ',') > 0 OR instr(',' || '{{volta_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "The presence of files named Identity_Report.txt or AI_Analysis.txt, or files created by known VOLTA processes.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_name" ], "rare_below": 3 }, "verified_at": "2026-11-01" } }, { "id": "triage-volta-behavior", "type": "analytic", "label": "Weigh the evidence for VOLTA", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "dns-leads-to-enrichment", "http-api-triage-requests", "file-artifact-creation" ], "objective": "Determine if the host exhibits the VOLTA behavior pattern: resolving enrichment domains, POSTing to OpenRouter, and creating report files.", "description": "The agent reviews the DNS leads, HTTP POSTs, and file artifacts to determine if a host is compromised by VOLTA.", "max_iterations": 5, "expected_signal": "A per-host verdict citing specific rows that link enrichment lookups to AI assessment calls.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing specific rows for each indicator." }, "parents": [ { "id": "http-api-triage-requests", "kind": "merge" }, { "id": "file-artifact-creation", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on VOLTA verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-volta-behavior verdict is malicious for at least one host", "condition": "the triage-volta-behavior verdict is malicious for at least one host", "blind_spot": "no-http-transparency", "confidence": "high", "description": "Route the findings to containment or manual review based on the agent verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-volta-behavior" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate host and revoke credentials", "config": { "target": "endpoint", "description": "Prevent further exfiltration and invalidate the stolen sessions being used for enrichment.", "instructions": "Isolate the endpoint. Immediately revoke the user's active sessions for Google (Gmail), Discord, and Slack, as these are actively being used for post-harvest enrichment.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Review AI dossiers and telemetry", "config": { "assignee": "analyst", "description": "Analyst manually verifies the agent's verdict and checks for additional compromised accounts.", "instructions": "Examine the Identity_Report.txt if it survived. Identify which third-party services were successfully enriched (e.g., UberEats, Roblox). Search for other hosts showing the same enrichment DNS pattern." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document the final state of the investigation.", "instructions": "Summarize the findings, record the number of hosts requiring remediation, and suggest detection rules for OpenRouter API POST activity." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }