Hive0163 Ransomware Operators Use AI-Generated Slopoly Malware

Researchers observed Hive0163 using a suspected LLM-generated PowerShell backdoor named 'Slopoly' as part of a multi-stage intrusion that began with ClickFix social-engineering and NodeSnake, progressed to InterlockRAT, and culminated in Interlock ransomware encryption; Slopoly acted as a C2/persistence client with JSON/HTTP beacons, scheduled-task persistence, and builder-generated variants, indicating experimentation with AI-assisted malware during active ransomware operations.