VOLTA uses multiple LLMs to rank stolen data by victim value

Talos reporting describes VOLTA collecting personal and credential data, enriching it through live accounts and receipts, then using Claude, Gemini, and Kimi to rank victims’ assets and prepare monetization dossiers. Model fallback, staged Telegram exfiltration, and reported use of a victim’s API key by NIK C2 make this a concrete case of AI-assisted criminal analysis, though the incremental impact of the models remains to be assessed.