InfoSecBulletin Cybersecurity for mankind
IBM X-Force reports that a money-driven threat group named Hive0163 used a probable AI-made malware called Slopoly in a ransomware attack in early 2026. IBM states that the malware allowed the attackers to maintain access to a hacked server for over a week during the later stage of the attack.
IBM says malware like Slopoly shows how bad actors can use AI to make new malware faster than older methods took.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
IBM connects the activities to Hive0163, a group linked to big data theft and ransomware. The company says the group used tools like NodeSnake, Interlock RAT, JunkFiction loader, and Interlock ransomware. In this case, Slopoly showed up later in the attack, which means the operators used it to maintain control after the first breach.
IBM found a PowerShell backdoor that seems to have been made with help from a big language model. There are many comments, detailed logs, good error handling, and neat variable names. The code calls itself a “Polymorphic C2 Persistence Client,” but IBM says the malware does not really act polymorphic and can’t change its own code while it runs.
Instead, Slopoly looks more like a practical backdoor built fast. IBM says it was likely generated through a builder that inserted fixed configuration values such as a session ID, mutex name, C2 URL, and beacon timings. The script reportedly lands in
C:\ProgramData\Microsoft\Windows\Runtime\
and creates persistence through a scheduled task named “Runtime Broker.”
Once active, Slopoly gathers basic system info, sends a signal to its command server every 30 seconds, looks for new commands every 50 seconds, runs those commands using cmd.exe, and sends the results back to the attackers.
cmd.exe
, and sends the results back to the attackers. IBM says it also keeps a local log file named
persistence.log
, which rolls over once it hits 1 MB.
IBM says the attack started with a ClickFix social engineering trick. In this method, people are fooled into copying a bad PowerShell command into the Windows Run box. IBM explains that this step installed NodeSnake, a type of malware based on NodeJS, which then helped bring in a bigger system called the Interlock framework, including Slopoly.
This case matters for two reasons. First, it proves that attackers don’t need fancy AI malware to use generative tools. Second, it aligns with IBM’s alert that AI is helping attackers work faster, even with simple code. IBM’s 2026 X-Force Threat Intelligence Index says companies should get ready for faster, larger, and more automated attacks through common entry points.
What IBM says Slopoly does
| Capability | IBM’s finding |
|---|---|
| Malware type | PowerShell backdoor and likely client component of a new C2 framework |
| Suspected developer aid | Likely generated with help from a large language model |
| Persistence | Scheduled task named “Runtime Broker” |
| Install path | C:\ProgramData\Microsoft\Windows\Runtime\ |
| Beacon interval | Every 30 seconds |
| Command polling | Every 50 seconds |
| Command execution | Viacmd.exe |
| Local logging | persistence.logwith rollover at 1 MB |
Key takeaway
Slopoly does not represent a leap in malware sophistication. It represents a drop in the effort required to build and field custom tooling during an attack.
That change could be important. If lesser-skilled hackers can create useful backdoors quicker, defenders might deal with more special malware, faster updates, and tougher tracking even if the code seems normal. IBM states this is just the start of a bigger competition between attackers and defenders using AI.
