Cybersecurity researchers at IBM X-Force have identified a suspected AI-assisted malware component known as Slopoly, attributed to a financially motivated threat group tracked as Hive0163. The malware serves a targeted role within multi-stage ransomware intrusion chains — specifically, maintaining long-term, covert access to compromised environments after the initial breach has already been established.

AI-Assisted Malware Development

Code analysis of the Slopoly malware reveals several structural characteristics commonly associated with AI-assisted development. Researchers noted the presence of highly structured inline comments that describe the purpose and logic of individual functions, verbose logging routines that output diagnostic information at each execution stage, deliberate error-handling blocks that gracefully manage failure conditions rather than crashing silently, and clearly descriptive variable and function names that suggest the code was written with readability as a design priority. Taken together, these traits are consistent with output produced by large language models, which tend to generate code that is well-annotated and self-documenting even when the underlying logic is relatively simple.

From a purely technical standpoint, the malware is not sophisticated. Its capabilities are well within reach of an experienced developer working manually. However, the significance of AI involvement lies not in what the malware does, but in how quickly and efficiently it was likely produced. Within the script itself, comments describe the tool as a “Polymorphic C2 Persistence Client,” indicating its intended role as a component within a broader command-and-control infrastructure. Slopoly joins a growing category of AI-assisted tools — alongside previously documented examples such as VoidLink and PromptSpy — that illustrate how threat actors are incorporating LLMs into their development workflows to accelerate iteration and reduce the engineering overhead of building new malicious tooling.

Hive0163 and the Broader Ransomware Ecosystem

Hive0163 is a financially motivated threat actor with an established history of data-theft extortion and ransomware deployment operations. The group maintains a diverse malware portfolio that spans multiple languages and operational stages. Known components include NodeSnake, a first-stage loader written to establish initial footholds; JunkFiction, a secondary loader used to stage additional payloads; Interlock RAT, a remote access trojan capable of interactive control over compromised systems; and Interlock ransomware, the final-stage payload deployed to encrypt victim data and extort payment. Slopoly represents a newer addition to this arsenal, filling a specific operational gap: maintaining persistence during the interval between initial compromise and ransomware deployment, a period in which the attacker needs reliable, quiet access without drawing attention.

In one ransomware incident investigated in early 2026, Slopoly was deployed during the post-exploitation phase of an attack and successfully maintained persistent access to a compromised server for more than a week before the final ransomware payload was delivered.

Persistence Mechanism and Anti-Detection Strategy

Slopoly is delivered as a PowerShell script, likely generated by a dedicated builder tool and written to C:\ProgramData\Microsoft\Windows\Runtime\ — a directory chosen to blend in with legitimate Windows runtime components. Persistence is established by registering a scheduled task under the name “Runtime Broker,” a deliberate impersonation of a legitimate Windows process (RuntimeBroker.exe) associated with managing application permissions for UWP apps. The scheduled task is configured to execute the malware at predefined intervals, ensuring it relaunches automatically following system reboots or process termination.

Although the malware refers to itself internally as polymorphic, dynamic analysis found no evidence of self-modification at runtime. The code does not alter its own structure or logic during execution. Instead, the polymorphic element appears to be handled by the builder tool itself, which likely generates fresh variants of the script with randomized function names, variable identifiers, and configuration parameters at build time. This approach effectively defeats static signature-based detection, as each generated instance presents a different byte-level profile to antivirus engines, while the behavioral fingerprint remains functionally identical.

Backdoor Capabilities and C2 Communication

Functionally, Slopoly operates as a lightweight PowerShell backdoor with a simple but effective command-and-control model. Once active, the malware transmits a heartbeat message to its remote C2 server approximately every 30 seconds, embedding basic system information such as hostname and environment details to allow the operator to track the status of active implants. Independently of the heartbeat, the malware polls the C2 server for new commands roughly every 50 seconds using a separate timer loop. When instructions are received, they are passed to cmd.exe for execution via Process.Start() or an equivalent invocation, and the resulting standard output is captured and returned to the operator over the same C2 channel.

The C2 protocol itself is straightforward — likely HTTP or HTTPS-based, consistent with common PowerShell-based backdoors — though the specific commands issued during observed intrusions have not been publicly disclosed. The design of the polling and heartbeat architecture suggests the implant is intended to support interactive, operator-driven control rather than fully automated behavior, keeping a human operator in the loop for decisions about lateral movement, data staging, or payload delivery.

Initial Access via ClickFix Social Engineering

The broader Hive0163 attack chain frequently begins with ClickFix-style social engineering, a technique in which victims are presented with a fake browser error, CAPTCHA challenge, or document rendering prompt that instructs them to manually copy and paste a command into their system. The pasted content is a malicious PowerShell one-liner, which the victim executes unknowingly in the belief that they are completing a legitimate action. This technique is particularly effective because it bypasses most browser and email security controls by placing the execution responsibility on the user rather than relying on a file download or exploit.

The PowerShell command initiates the download and execution of NodeSnake, the group’s first-stage loader. NodeSnake is capable of executing arbitrary shell commands, establishing its own persistence mechanism, and reaching back to attacker-controlled infrastructure to retrieve and load additional malware components. Its primary role is to stage the environment for the follow-on deployment of Interlock RAT, which provides the interactive access layer operators use to navigate the compromised network.

The Interlock Framework

The Interlock framework used by Hive0163 is a multi-platform, multi-language toolset designed to operate across heterogeneous enterprise environments. Components have been observed written in PowerShell, PHP, C/C++, Java, and JavaScript, enabling deployment across both Windows and Linux endpoints. Once active, framework components communicate with remote infrastructure over encrypted channels to receive operator instructions. Supported capabilities include launching SOCKS5 proxy tunnels to relay traffic through the victim network, spawning reverse shells for interactive access, fetching and executing additional payloads, and ultimately delivering Interlock ransomware or supplementary tools such as Slopoly as the operation progresses.

Alternative Initial Access via Broker Networks

Beyond direct social engineering, Hive0163 has also been observed acquiring network access through initial access brokers — specialized criminal intermediaries who compromise target organizations and sell the resulting footholds to other threat actors. Two brokers associated with Hive0163 operations are TA569, also known as SocGholish, which distributes malware through compromised legitimate websites by injecting malicious JavaScript into site content, and TAG-124, tracked under the aliases KongTuke and LandUpdate808, which similarly abuses legitimate web infrastructure to redirect victims toward malware delivery pages. The use of broker networks allows Hive0163 to expand the volume of its operations without investing resources in the initial compromise phase, effectively purchasing a head start and concentrating its capabilities on post-exploitation activity.

Implications for the Threat Landscape

The emergence of Slopoly underscores a trend that security researchers have been tracking with increasing concern: the operational integration of AI tools into the malware development lifecycle. While AI-generated malware may not introduce fundamentally novel attack techniques, the implications for defenders are meaningful. Threat actors who previously lacked the development capacity to build custom tooling can now produce functional, well-structured malware components with less effort and in less time. The ability to generate new, syntactically varied builds of the same tool on demand makes signature-based detection less reliable, and the accelerated iteration cycle means that defenders face a higher volume of novel samples requiring analysis. The primary impact, in short, is not technical sophistication but operational velocity hence Slopoly is an early indicator of how that velocity is beginning to manifest in real-world ransomware operations.

References: