IBM Discovers ‘Slopoly’ AI-Generated Malware Linked to Hive0163 Ransomware

Hive0163, a financially driven ransomware group, is testing a probable AI-generated malware framework named “Slopoly,” signaling a rapid shift toward AI-assisted tooling in attacks.

While the malware is simple, its implementation reveals how quickly threat actors can create and iterate on custom command-and-control clients using large language models (LLMs).

The group is linked to major global ransomware incidents involving Interlock ransomware for data theft and extortion.

Hive0163 utilizes a growing arsenal of private crypters and backdoors, including NodeSnake, InterlockRAT, JunkFiction loader, and Interlock ransomware, offering flexible persistence, lateral movement, and scalable encryption.

In the investigation by IBM X-Force conducted in early 2026, the group deployed multiple backdoors before introducing Slopoly late in the intrusion, indicating testing under live-fire conditions during active ransomware operations.

This aligns with industry reports that ransomware operators are integrating AI assistance into existing playbooks rather than replacing tooling outright.

Slopoly: AI-assisted PowerShell C2 client

X-Force analysts discovered a PowerShell script acting as the client component of a new C2 framework they named “Slopoly” on an infected server during a ransomware engagement.

The intrusion traced back to a ClickFix social engineering attack that tricked the victim into executing a malicious PowerShell command from the Windows Run dialog.

The script was dropped under “C:\ProgramData\Microsoft\Windows\Runtime\” and persisted via a scheduled task named “Runtime Broker,” maintaining Hive0163 access for over a week.

The code exhibits LLM hallmarks: extensive comments, verbose logging, clean error handling, and descriptive variable names, including labels like “Polymorphic C2 Persistence Client” despite lacking true polymorphism.

Slopoly periodically sends JSON “heartbeat” beacons to its C2 server and executes commands via HTTP through cmd.exe, logging activity to a persistence.log file.

This initial command deployed NodeSnake, a Node.js-based first-stage C2 client that can download payloads, execute shell commands, self-update, and adjust beacon intervals via HTTP.

Hive0163 used NodeSnake to deliver InterlockRAT, a JavaScript-based backdoor adding WebSocket C2, SOCKS5 tunneling, and reverse shell functionality.

Interlock ransomware behavior

The Windows variant of Interlock was deployed as a 64-bit PE payload wrapped inside the JunkFiction loader, typically dropped in a temporary user directory.

Interlock supports command-line options including encrypting a directory or file, running as a scheduled task, self-deletion after execution, and storing encryption keys in a dedicated folder.

In later stages, Slopoly was deployed alongside ransomware tools like AzCopy for data exfiltration and Advanced IP Scanner for network reconnaissance before triggering the Interlock ransomware attack for file encryption.

The ransomware scans all logical drives, skipping system directories and critical files, encrypts targeted files with AES-GCM using per-file session keys protected by RSA, appends a custom extension, and leaves ransom notes like FIRST_READ_ME.txt.

It uses the Windows Restart Manager API to release file locks by stopping processes, enhancing reliability before removing traces of its scheduled task and optionally the encryptor.

Technically, Slopoly is not sophisticated, but its likely LLM origin underscores how quickly attackers can now produce “good enough” backdoors tailored to specific operations.

This aligns with findings from Palo Alto Networks’ Unit 42, which reports AI acting as a force multiplier, compressing attack timelines, lowering barriers, and enabling operators to scale campaigns with templated, AI-assisted scripts.

IBM X-Force assesses the model was probably less advanced, yet it still generated a fully functional C2 client that bypassed guardrails and was operationalized by a high-impact ransomware group.

As access to weaponizable AI broadens, defenders must adapt detection, attribution, and incident response practices to cope with more ephemeral, rapidly generated malware families that are harder to cluster and track.