Hive0163's AI-Generated Slopoly Malware: A New Era of Ransomware Attacks
In early 2026, the financially motivated threat actor Hive0163 executed a ransomware attack utilizing an AI-generated malware named Slopoly. The attack began with a social engineering tactic called ClickFix, tricking victims into executing a PowerShell command that downloaded NodeSnake, a known malware associated with Hive0163. NodeSnake established persistence and facilitated the deployment of Interlock RAT, which in turn delivered Slopoly. Slopoly, developed with the assistance of a large language model, functioned as a backdoor, maintaining persistent access to the compromised server for over a week. It communicated with a command-and-control server, enabling the execution of commands and exfiltration of data. This incident underscores the evolving threat landscape where AI is leveraged to expedite malware development, reducing the time required for threat actors to create and deploy sophisticated attacks. The use of AI in malware creation signifies a shift towards more efficient and scalable cyber threats, necessitating enhanced defensive measures and vigilance.
Kill Chain
