Hive0163 deploys AI-generated Slopoly malware to maintain persistent access in ransomware attacks

Hive0163 Leverages AI-Generated Malware in Sophisticated Attack Chain

Cybersecurity researchers at IBM X-Force have disclosed details about Slopoly malware, a suspected AI-generated threat deployed by the financially motivated threat actor Hive0163 during an Interlock ransomware attack observed in early 20261

1

. The e-crime group used the PowerShell-based backdoor to maintain persistent access to a compromised server for more than a week, demonstrating how threat actors are increasingly weaponizing artificial intelligence to accelerate custom malware development2

2

.

Hive0163's operations center on extortion through large-scale data exfiltration and ransomware deployment. The group has established associations with various malicious tools including NodeSnake, Interlock RAT, JunkFiction loader, and Interlock ransomware, along with potential connections to developers behind Broomstick, SocksShell, and Rhysida ransomware operators2

2

.

Evidence Points to Large Language Model Development

IBM X-Force researcher Golo Mühr identified strong indicators that Slopoly malware was developed using a large language model, though the specific AI tool remains undetermined1

1

. The evidence includes extensive comments throughout the code, structured logging, sophisticated error handling, and accurately named variables—characteristics rarely seen in human-developed malware2

2

.

Comments within the script describe it as a "Polymorphic C2 Persistence Client," suggesting it functions as part of a command-and-control (C2) framework. However, researchers found the malware lacks advanced techniques and cannot truly be considered polymorphic since it's unable to modify its own code during execution1

1

. The builder may generate new clients with different randomized configuration values and function names, which represents standard practice among malware builders.

Technical Capabilities Enable Persistent Access

The Slopoly malware functions as a full-fledged backdoor deployed via a PowerShell script, likely generated by a builder that establishes persistent access through a scheduled task called "Runtime Broker"1

1

. The malware beacons a heartbeat message containing system information to its command-and-control server every 30 seconds and polls for new commands every 50 seconds, executing them via cmd.exe and relaying results back to the server1

1

.

The supported commands allow downloading and executing EXE, DLL, or JavaScript payloads; running shell commands and returning results; changing beaconing intervals; updating itself; or exiting its own process2

2

. This functionality enables attackers to maintain control over compromised systems while deploying additional payloads.

Multi-Stage Attack Leverages Social Engineering and Multiple Malware Components

The attack chain began with a ClickFix social engineering tactic designed to trick victims into running a PowerShell command that downloads NodeSnake, a known malware attributed to Hive0163. NodeSnake serves as a first-stage component designed to run shell commands, establish persistence, and retrieve and launch the broader Interlock RAT framework.

Hive0163 has a documented track record of employing ClickFix and malvertising for initial access, while also relying on initial access brokers such as TA569 (SocGholish) and TAG-124 (KongTuke and LandUpdate808). The Interlock framework has multiple implementations in PowerShell, PHP, C/C++, Java, and JavaScript to support both Windows and Linux environments, communicating with remote servers to launch SOCKS5 proxy tunnels, spawn reverse shells, and deliver additional payloads including Interlock ransomware and Slopoly1

1

.

AI-Assisted Malware Development Accelerates Threat Landscape

The emergence of Slopoly adds to a growing list of AI-assisted malware including VoidLink and PromptSpy, highlighting how threat actors are using artificial intelligence to scale their operations1

1

. "Although still relatively unspectacular, AI-generated malware such as Slopoly shows how easily threat actors can weaponize AI to develop new malware frameworks in a fraction of the time it used to take," Mühr stated in the report1

1

.

While IBM X-Force noted that AI-generated malware does not pose a new or sophisticated threat from a technical standpoint, it disproportionately enables threat actors by reducing the time an operator needs to develop and execute an attack1

1

. The deployment of Slopoly in ransomware operators' attack chains indicates that AI tools are actively being used to accelerate custom malware development, which can help evade detection systems2

2

. Organizations should monitor for increased velocity in threat actor operations and watch for malware samples exhibiting extensive commenting and structured code patterns that may indicate AI-assisted development.