Hive0163 Used AI-Generated Slopoly Malware in Ransomware Attacks
IBM X-Force researchers discovered that the financially motivated threat group Hive0163 deployed AI-generated malware called Slopoly during ransomware attacks in early 2026 to maintain persistent access. The PowerShell backdoor, likely created with a large language model, functioned as a command-and-control client collecting system data and executing remote commands.
What happened
IBM X-Force researchers uncovered the PowerShell backdoor Slopoly during a ransomware investigation in early 2026, discovering it was likely generated with a large language model.
Hive0163 deployed Slopoly during ransomware attacks to maintain persistent access to compromised servers for more than a week. The malware was installed during the post-exploit phase and established persistence via a scheduled task called 'Runtime Broker.'
Reported impact
Slopoly functioned as a command-and-control client that collected system data, sent heartbeat beacons to remote servers, executed commands via cmd.exe, and maintained persistent access to infected systems.
Index analysis
Experts believe Slopoly was AI-generated based on extensive comments, accurately named variables, error handling, and logging throughout the code. IBM X-Force researcher Golo MΓΌhr noted that 'AI-generated malware such as Slopoly shows how easily threat actors can weaponize AI to develop new malware frameworks in a fraction of the time it used to take.'
The malware was not technically sophisticated or truly polymorphic, but the builder could generate new clients with different randomized configuration values and function names. IBM X-Force stated that 'the introduction of AI-generated malware does not pose a new or sophisticated threat from a technical standpoint' but 'disproportionately enables threat actors by reducing the time an operator needs to develop and execute an attack.'
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.