Hive0163 Slopoly AI-Generated Backdoor and Interlock Ransomware Campaign — Threadlinqs Intelligence
As of 2026-05-30, Hive0163 Slopoly AI-Generated Backdoor and Interlock Ransomware Campaign is a high-severity malware threat attributed to Hive0163 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 55 indicators of compromise.
Threat ID: TL-2026-0227 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Hive0163 · Russia · FINANCIAL
IBM X-Force identified Hive0163, a financially motivated e-crime group, deploying Slopoly — the first confirmed AI-generated backdoor malware — in Interlock ransomware operations. The attack chain
Hive0163 is a financially motivated cybercriminal group specializing in post-compromise activity, large-scale data exfiltration, and ransomware deployment. IBM X-Force discovered the Slopoly malware during a ransomware engagement in early 2026, marking the first confirmed use of an AI-generated backdoor in production ransomware operations.
ATTACK CHAIN:
The campaign begins with ClickFix social engineering — victims encounter a fake CAPTCHA-like verification page that stores a malicious PowerShell script to the Windows clipboard. The user is manipulated into pressing Win+R to open the Run dialog, Ctrl+V to paste the script, and Enter to execute it. This delivers NodeSnake, a NodeJS-based first-stage C2 framework capable of downloading and executing EXE, DLL, and JavaScript payloads, executing shell commands, establishing persistence, and self-updating.
Following NodeSnake deployment, Hive0163 deploys InterlockRAT — a JavaScript-based second-stage backdoor with capabilities including SOCKS5 proxy tunneling, reverse shell spawning, and payload delivery. The RAT exists in multiple implementations across PowerShell, PHP, C/C++, Java, and JavaScript for both Windows and Linux.
SLOPOLY BACKDOOR:
Slopoly is a PowerShell-based C2 framework that self-describes as a Polymorphic C2 Persistence Client, though it lacks actual polymorphic capabilities (no self-modification during execution). It deploys to C:\ProgramData\Microsoft\Windows\Runtime\ and establishes persistence via a scheduled task named Runtime Broker. The backdoor sends heartbeat beacons every 30 seconds containing system information (public IP, elevation status, session ID, username, hostname) as JSON to /api/commands via HTTP POST, and polls for commands every 50 seconds. Commands are executed through cmd.exe.
AI-generation indicators include: extensive inline comments throughout the code, comprehensive error handling, an unused Jitter function (iterative development artifact), accurately named variables suggesting intentional malicious design, and structured logging to persistence.log with 1 MB rollover. The Slopoly builder generates new clients with randomized configuration values including function names, session IDs, mutex names, C2 URLs, and beacon intervals. Analysis suggests it was generated by a less advanced LLM model that successfully circumvented AI guardrails.
INTERLOCK RANSOMWARE:
The final payload is Interlock ransomware — a 64-bit Windows PE deployed via the JunkFiction loader to a single-digit numbered temporary folder. It uses AES-GCM for per-file encryption with RSA-protected session keys (OpenSSL v3.5.0 statically linked). Command-line arguments include: -d (directory), -f (file), -del (self-delete after execution), -s (execute as scheduled task with SYSTEM privileges via schtasks), -r (use Restart Manager API to release file locks before encryption), and -u (store encrypted keys externally in C:\!_KEYS_FOR_DECRYPT_!\). Files receive dual extensions such as .!NT3RLOCK or .int3R1Ock, and ransom notes (FIRST_READ_ME.txt) are dropped in each encrypted directory. Self-deletion uses an embedded DLL with .wasd extension executed via rundll32.exe.
THREAT ACTOR PROFILE:
Hive0163 maintains relationships with ex-ITG23 crypter developers and has connections to malware families including Broomstick (Oyster/CleanUpLoader), Supper (SocksShell), PortStarter, and SystemBC. They leverage initial access brokers including TA569 (SocGholish) and TAG-124 (Landupdate808/KongTuke TDS). Operational tools include AzCopy for data exfiltration and Advanced IP Scanner for lateral movement. The group operates as dynamic subclusters with access to shared private crypters, malware frameworks, and ransomware variants.
C2 INFRASTRUCTURE:
Slopoly primary C2 server was plurfestivalgalaxy.com (94.156.181.89), which is no longer active. Hive0163 maintains additional C2 infrastructure across multiple IP addresses (77.42.75.119, 23.227.203.123, 172.86.68.64) and extensively abuses Cloudf
Target sectors: healthcare, education, enterprise
Target regions: North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 55 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1204.001, T1204.002, T1059.001, T1059.003, T1059.007, T1053.005, T1053.005, T1070.004, T1218.011