Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access in Ransomware Attacks

**Slopoly** is an AI-assisted PowerShell backdoor attributed to financially motivated actor **Hive0163** that was observed used during post-exploitation to maintain persistent access (via a scheduled task named "Runtime Broker") and to beacon/poll a C2 for commands; it appears to be part of a larger malware chain including NodeSnake and Interlock RAT used for data exfiltration and ransomware deployment.