Hive0163 uses AI malware Slopoly in ransomware attacks

Cybersecurity researchers have revealed details of a suspicious artificial intelligence (AI)-powered malware codenamed Slopoly . The malware is being used by a financially motivated threat group called Hive0163 .

“While still relatively small, AI-powered malware like Slopoly demonstrates how easily threat actors can leverage AI to develop new malware frameworks much faster than before,” said IBM X-Force researcher Golo Mühr.

Hive0163's operations are based on extortion through large-scale extraction and ransomware. The cybercrime group is associated with a wide range of malicious tools, including NodeSnake, Interlock RAT, JunkFiction loader, and Interlock ransomware.

In a ransomware attack observed in early 2026, the threat actor deployed Slopoly during the post-exploitation phaseto maintain persistent access to the compromised server for more than a week.

See also: 6 new Android malware targets banking apps

Slopoly: New malware created with AI

The discovery of Slopoly can be linked to a PowerShell script that was probably developed via a builder and deployed to the “C:\ProgramData\Microsoft\Windows\Runtime\” folder. The persistence was established via a scheduled task called “Runtime Broker”.

There are indications that the malware was developed with the help of an unspecified large language model (LLM). Extensive comments, logging, error handling, and properly named variables were observed. The comments describe the script as a “Polymorphic C2 Persistence Client”, indicating that it is part of a command-and-control (C2) framework.

“However, the script lacks any advanced techniques and can hardly be considered polymorphic, as it is unable to modify its own code during execution,” Mühr noted. “The builder can, however, create new clients with different random configuration values ​​and function names, which is common practice among malware builders.”

See also: BeatBanker: Android malware mimics Starlink app to compromise devices

The PowerShell script acts as a complete backdoor that can send a heartbeat message with system informationto a C2 server every 30 seconds. It can also check for a new command every 50 seconds, execute it via “cmd.exe”, and transfer the results back to the server. The exact nature of the commands executed on the compromised network is currently unknown.

Using ClickFix technique

The attack leveraged the ClickFix social engineering to trick a victim into executing a PowerShell command, which then downloads NodeSnake, a known malware attributed to Hive0163. NodeSnake is designed to execute shell commands, establish persistence, and retrieve and launch a broader malware framework referred to as the Interlock RAT.

Hive0163 has a history of using the ClickFix and malvertising for initial access. Another method the threat actor uses for access is relying on initial access brokers, such as TA569 (also known as SocGholish) and TAG-124 (also known as KongTuke and LandUpdate808).

The framework has multiple implementations in PowerShell, PHP, C/C++, Java, and JavaScript to support both Windows and Linux. Like NodeSnake, it communicates with a remote server to retrieve commands that allow it to launch a SOCKS5 proxy tunnel, create a reverse shell on the infected machine , and deliver more payloads, such as the Interlock ransomware and Slopoly.

See also: Malicious CAPTCHA tricks Mac users into installing malware via Terminal

Slopoly's emergence joins a growing list of AI-assisted malware, which also includes VoidLink and PromptSpy. The new AI-generated malware shows how malicious actors are using technology to accelerate malware development and scale their operations.

“The introduction of AI-generated malware is not a new or advanced threat from a technical perspective,” IBM X-Force said. “It disproportionately assists threat actors by reducing the time it takes an operator to develop and execute an attack.”