IBM Discovers ‘Slopoly’ AI-Generated Malware Linked to Hive0163 Ransomware

IBM X‑Force observed Hive0163 using multiple staged backdoors and a likely LLM‑generated PowerShell C2 client named "Slopoly" during an Interlock ransomware operation; the report details the ClickFix social engineering vector, persistence via a "Runtime Broker" scheduled task, JSON heartbeat beaconing, deployment chain (NodeSnake → InterlockRAT → Interlock ransomware), AES‑GCM per-file encryption, and supporting tooling for data exfiltration and reconnaissance, highlighting how AI assistance is accelerating malware development and operationalization.