Researchers Link Suspected AI-Generated Slopoly Malware to Hive0163 Ransomware Intrusion
Summary
IBM X-Force researchers linked suspected LLM-generated PowerShell C2 tool Slopoly to a 2026 Hive0163 ransomware intrusion. Slopoly maintained access and ran commands; ClickFix, NodeSnake and InterlockRAT preceded Interlock ransomware.
Key points
- IBM X-Force analysts found Slopoly during an investigation of a 2026 Hive0163 intrusion and said attackers retained access to the server for more than a week.
- Slopoly was a PowerShell C2 client that sent system information in JSON to /api/commands, checked for commands, and executed them through cmd.exe.
- A builder reportedly deployed Slopoly to C:ProgramDataMicrosoftWindowsRuntime and created a scheduled task named “Runtime Broker” for persistence.
- Comments, logging, error handling, variable names and an unused “Jitter” function led researchers to suspect LLM-assisted generation; they could not identify the model.
- The intrusion began with ClickFix social engineering, followed by NodeSnake and InterlockRAT, before Interlock ransomware was deployed using the JunkFiction loader.
- Interlock encrypted targeted files using AES-GCM and RSA, according to the article.
Article Details
- Attack Vectors
- ClickFix social engineering prompted victims to paste and execute a malicious PowerShell script.
- The PowerShell payload installed NodeSnake, which later deployed InterlockRAT; Interlock ransomware was then delivered using the JunkFiction loader.
MITRE ATT&CK
T1053.005 · Scheduled TaskSlopoly established persistence by creating a scheduled task named “Runtime Broker.”T1059.001 · PowerShellThe initial ClickFix payload was executed through PowerShell.T1059.003 · Windows Command ShellSlopoly executed instructions received from its C2 server using cmd.exe.T1071.001 · Web ProtocolsSlopoly sent JSON beacons and checked for commands using HTTP POST requests to the /api/commands endpoint.T1082 · System Information DiscoverySlopoly collected system information, including the computer name, user account name, and privilege status.T1105 · Ingress Tool TransferNodeSnake supported downloading and executing additional payloads.T1204.004 · Malicious Copy and PasteClickFix tricked victims into pasting and executing a malicious script copied to their clipboard.T1486 · Data Encrypted for ImpactInterlock ransomware encrypted targeted files across logical drives.
Threat Actors
Malware
InterlockC2 persistence client deployed late in the attack chain alongside NodeSnake, InterlockRAT and Interlock ransomware, indicating threat actors are experimenting with LLM-assisted malware generation.InterlockRATas a PowerShell-based C2 persistence client deployed late in the attack chain alongside NodeSnake, InterlockRAT and Interlock ransomware, indicating threat actors are experimenting with LLM-assisted malwareJunkFictionInitial access employed ClickFix social engineering to run PowerShell, which installed NodeSnake and later InterlockRAT before Interlock ransomware was deployed via the JunkFiction loader.NodeSnakeSlopoly acted as a PowerShell-based C2 persistence client deployed late in the attack chain alongside NodeSnake, InterlockRAT and Interlock ransomware, indicating threat actors are experimenting with LLM-assistedSlopolyResearchers identified a suspected case of AI-generated malware called Slopoly used by the financially motivated group Hive0163 during a 2026 ransomware intrusion.