Cisco Talos finds model-driven victim appraisal in VOLTA malware
In its October 31 analysis, Talos describes stolen-data bundles sent to models for asset ranking, with fallback models if one refuses.
ThereforeThe malware automates the operator's work of deciding which stolen assets to pursue.