Back Scworld

AI-generated malware Slopoly used in Interlock ransomware attacks | brief

Scworld • March 13, 2026

As reported by Bleeping Computer, a new malware strain named Slopoly, believed to be developed using generative AI tools, has been identified as a component in recent Interlock ransomware attacks. This backdoor allowed attackers to maintain access to compromised servers for over a week, facilitating significant data exfiltration.

The attack chain begins with the social engineering tactic known as ClickFix. Once inside a system, threat actors deploy Slopoly as a PowerShell script, functioning as a client for a command-and-control (C2) framework. IBM X-Force researchers noted unusual code structure, extensive , and well-defined variables, suggesting AI assistance in its creation. While Slopoly itself is not highly sophisticated, its use by the financially motivated Hive0163 group highlights the growing trend of AI accelerating custom malware development to evade detection.

The malware collects system information, executes commands remotely, and establishes persistence through scheduled tasks. In observed attacks, Slopoly was deployed alongside other backdoors like NodeSnake and InterlockRAT, culminating in the Interlock ransomware payload.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hive0163 Ransomware Group Deploys AI-Generated Slopoly Malware In a recent ransomware attack, the Hive0163 group utilized a new malware strain named Slopoly, suspected to be generated by AI tools. The attack began with a ClickFix social engineering tactic, allowing the threat actors to maintain access to a compromised server for over a week. Slopoly, identified as a PowerShell script, served as a client for the command-and-control (C2) framework and was deployed during the later stages of the attack. IBM X-Force researchers noted that the malware exhibited characteristics typical of AI-assisted development, including structured logging and clear variable naming. Despite its AI origins, Slopoly was deemed unsophisticated, lacking advanced features like polymorphism. The group has a history of targeting high-profile organizations and is primarily motivated by financial gain through data theft and extortion. The investigation revealed that Slopoly was deployed in the directory C:\ProgramData\Microsoft\Windows\Runtime\, and the malware's builder tool inserted various configuration values. The incident highlights the growing trend of cybercriminals leveraging AI in malware development. 8 sources 52

Extracted Entities

AI-generated malware Slopoly used in Interlock ransomware attacks | brief

The full story

Extracted Entities

Attack Types (1)

Malware (3)

MITRE ATT&CK (4)

Ransomware Groups (1)

Tools (1)