# Hive0163 Slopoly AI-Generated Backdoor and Interlock Ransomware Campaign

> IBM X-Force identified Hive0163, a financially motivated e-crime group, deploying Slopoly — the first confirmed AI-generated backdoor malware — in Interlock ransomware operations. The attack chain leverages ClickFix social engineering for initial access, NodeSnake as first-stage C2, Slopoly as a persistent PowerShell backdoor, and Interlock ransomware for encryption and data exfiltration.

- **Published:** 2026-03-14T12:00:00Z
- **Last reviewed:** 2026-03-14T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0227
- **ID:** TL-2026-0227
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Hive0163 (Russia)
- **Detections:** 9 · **IOCs:** 55 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Hive0163 is a financially motivated cybercriminal group specializing in post-compromise activity, large-scale data exfiltration, and ransomware deployment. IBM X-Force discovered the Slopoly malware during a ransomware engagement in early 2026, marking the first confirmed use of an AI-generated backdoor in production ransomware operations.

ATTACK CHAIN:
The campaign begins with ClickFix social engineering — victims encounter a fake CAPTCHA-like verification page that stores a malicious PowerShell script to the Windows clipboard. The user is manipulated into pressing Win+R to open the Run dialog, Ctrl+V to paste the script, and Enter to execute it. This delivers NodeSnake, a NodeJS-based first-stage C2 framework capable of downloading and executing EXE, DLL, and JavaScript payloads, executing shell commands, establishing persistence, and self-updating.

Following NodeSnake deployment, Hive0163 deploys InterlockRAT — a JavaScript-based second-stage backdoor with capabilities including SOCKS5 proxy tunneling, reverse shell spawning, and payload delivery. The RAT exists in multiple implementations across PowerShell, PHP, C/C++, Java, and JavaScript for both Windows and Linux.

SLOPOLY BACKDOOR:
Slopoly is a PowerShell-based C2 framework that self-describes as a Polymorphic C2 Persistence Client, though it lacks actual polymorphic capabilities (no self-modification during execution). It deploys to C:\ProgramData\Microsoft\Windows\Runtime\ and establishes persistence via a scheduled task named Runtime Broker. The backdoor sends heartbeat beacons every 30 seconds containing system information (public IP, elevation status, session ID, username, hostname) as JSON to /api/commands via HTTP POST, and polls for commands every 50 seconds. Commands are executed through cmd.exe.

AI-generation indicators include: extensive inline comments throughout the code, comprehensive error handling, an unused Jitter function (iterative development artifact), accurately named variables suggesting intentional malicious design, and structured logging to persistence.log with 1 MB rollover. The Slopoly builder generates new clients with randomized configuration values including function names, session IDs, mutex names, C2 URLs, and beacon intervals. Analysis suggests it was generated by a less advanced LLM model that successfully circumvented AI guardrails.

INTERLOCK RANSOMWARE:
The final payload is Interlock ransomware — a 64-bit Windows PE deployed via the JunkFiction loader to a single-digit numbered temporary folder. It uses AES-GCM for per-file encryption with RSA-protected session keys (OpenSSL v3.5.0 statically linked). Command-line arguments include: -d (directory), -f (file), -del (self-delete after execution), -s (execute as scheduled task with SYSTEM privileges via schtasks), -r (use Restart Manager API to release file locks before encryption), and -u (store encrypted keys externally in C:\!_KEYS_FOR_DECRYPT_!\). Files receive dual extensions such as .!NT3RLOCK or .int3R1Ock, and ransom notes (FIRST_READ_ME.txt) are dropped in each encrypted directory. Self-deletion uses an embedded DLL with .wasd extension executed via rundll32.exe.

THREAT ACTOR PROFILE:
Hive0163 maintains relationships with ex-ITG23 crypter developers and has connections to malware families including Broomstick (Oyster/CleanUpLoader), Supper (SocksShell), PortStarter, and SystemBC. They leverage initial access brokers including TA569 (SocGholish) and TAG-124 (Landupdate808/KongTuke TDS). Operational tools include AzCopy for data exfiltration and Advanced IP Scanner for lateral movement. The group operates as dynamic subclusters with access to shared private crypters, malware frameworks, and ransomware variants.

C2 INFRASTRUCTURE:
Slopoly primary C2 server was plurfestivalgalaxy.com (94.156.181.89), which is no longer active. Hive0163 maintains additional C2 infrastructure across multiple IP addresses (77.42.75.119, 23.227.203.123, 172.86.68.64) and extensively abuses Cloudflare tunnel infrastructure with over 30 randomized tunnel domains for resilience and evasion.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1053.005 Scheduled Task
- T1070.004 File Deletion
- T1218.011 Rundll32
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1018 Remote System Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1102.002 Bidirectional Communication
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1587.001 Malware
- T1588.002 Tool

## Sources

- [A Slopoly Start to AI-Enhanced Ransomware Attacks — IBM X-Force](https://www.ibm.com/think/x-force/slopoly-start-ai-enhanced-ransomware-attacks)
- [Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access — The Hacker News](https://thehackernews.com/2026/03/hive0163-uses-ai-assisted-slopoly.html)
- [AI-generated Slopoly malware used in Interlock ransomware attack — BleepingComputer](https://www.bleepingcomputer.com/news/security/ai-generated-slopoly-malware-used-in-interlock-ransomware-attack/)
- [AI-assisted Slopoly malware powers Hive0163 ransomware campaigns — Security Affairs](https://securityaffairs.com/189378/malware/ai-assisted-slopoly-malware-powers-hive0163s-ransomware-campaigns.html)
- [Slopoly: AI-Generated Malware Used By Hive0163 In Attacks — The Cyber Express](https://thecyberexpress.com/slopoly-ai-generated-malware/)
- [Even primitive AI-coded malware helps hackers move faster, thwart attribution — Cybersecurity Dive](https://www.cybersecuritydive.com/news/ai-ransomware-backdoor-ibm-attribution/814671/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0227