Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access in Ransomware Attacks

IBM X-Force researchers detail Slopoly, an AI-generated PowerShell backdoor used by threat actor Hive0163 in ransomware attacks.

• •Slopoly was deployed during post-exploitation to maintain persistent access to compromised servers for over a week
• •AI authorship is indicated by extensive comments, detailed logging, error handling, and accurately named variables; the script self-describes as a "Polymorphic C2 Persistence Client"
• •The backdoor beacons system info to a C2 server every 30 seconds and polls for commands every 50 seconds, executing them via cmd.exe
• •Hive0163 used ClickFix social engineering to deploy NodeSnake, which then loaded Interlock RAT and subsequently Slopoly
• •IBM X-Force concludes AI-generated malware lowers development time for attackers but does not introduce technically advanced new capabilities