Listen to this Post
Introduction
Cybersecurity researchers are increasingly observing signs that attackers are beginning to integrate artificial intelligence into their malware development workflows. A recent investigation by IBM security researchers revealed a new malware strain called Slopoly, which appears to have been generated with the assistance of generative AI tools. The malware was deployed during an attack linked to the ransomware operation known as Interlock ransomware, allowing threat actors to remain inside a compromised server for more than a week while quietly stealing sensitive data.
The discovery highlights a growing shift in cybercrime. Instead of relying solely on experienced malware developers, attackers may now be using large language models and automated builders to generate malicious code faster. Even though Slopoly itself is not technically advanced, its presence in a real-world ransomware intrusion suggests that AI-assisted malware development is becoming a practical tool for cybercriminal groups seeking efficiency, stealth, and scalability.
AI-Assisted Malware Appears in a Real Attack
Security analysts from IBM X-Force examined the Slopoly script after discovering it during a ransomware investigation. The malware was deployed after attackers initially compromised the victim using a social engineering technique known as ClickFix, which tricks users into executing malicious actions through deceptive instructions.
Once the attackers gained a foothold, they installed Slopoly as a PowerShell-based backdoor that connected the infected system to a remote command-and-control infrastructure. This backdoor allowed attackers to issue commands, collect system data, and maintain access to the system while other malicious tools were deployed during the attack.
During the forensic analysis, researchers noticed unusual characteristics in the code. The script contained extensive comments, clear variable naming, structured logging, and well-organized error handling. These features are uncommon in most malware samples written manually by cybercriminals. Such patterns strongly suggest the code may have been generated or assisted by a large language model (LLM), although the researchers were unable to determine which AI system may have been used.
The Role of Slopoly in the Attack Chain
Although Slopoly played a key role in maintaining access to the compromised environment, the malware itself is not particularly sophisticated. The attackers used it mainly as a communication client between the infected machine and their remote infrastructure.
The malware was deployed in the directory:
C:ProgramDataMicrosoftWindowsRuntime
From there, it carried out several key functions designed to support the broader ransomware operation.
These functions included gathering system information, establishing persistence mechanisms, executing commands from the attackers, and sending the results back to the command server. The malware also created a scheduled task disguised as Runtime Broker, allowing it to automatically run whenever the system restarted.
Another important function of the malware involved continuous communication with the attacker’s command server. Slopoly sends a heartbeat beacon every 30 seconds, letting the attackers know the compromised machine is still active. It also polls the command server every 50 seconds for instructions.
This constant communication allows attackers to dynamically control the infected machine, deploy additional malware, or adjust their tactics during the intrusion.
Command Capabilities and Remote Control
Slopoly functions as a flexible backdoor capable of executing multiple types of commands. Once installed on a system, it allows attackers to perform a variety of actions remotely.
These capabilities include downloading and running additional executable files, dynamic link libraries, or JavaScript payloads. Attackers can also run shell commands on the infected machine and receive the command output directly from the victim system.
In addition, the malware can update its own code, modify beaconing intervals, and terminate itself when necessary. Such flexibility allows threat actors to adapt the malware during the attack without requiring new infections.
Despite the script describing itself as a “Polymorphic C2 Persistence Client,” the researchers determined that the malware does not actually possess polymorphic behavior. It cannot modify its own code during execution, which is typically a defining characteristic of polymorphic malware.
However, the researchers believe the builder used to generate the malware could produce new variants with randomized configuration values and function names. This approach is commonly used in malware builders to avoid signature-based detection.
The Threat Group Behind the Operation
The attack was attributed to a financially motivated threat group tracked by researchers as Hive0163. According to the investigation, the group’s main objective is extortion through large-scale data theft combined with ransomware deployment.
Hive0163 has previously been associated with multiple malware families and cybercrime tools. Researchers believe the group may also have connections with the developers behind several known cybercriminal utilities, including Broomstick, SocksShell, PortStarter, SystemBC, and operators linked to the Rhysida ransomware ecosystem.
The ransomware payload used in the observed attack was delivered through a loader called JunkFiction. Once executed, the ransomware runs as a scheduled task with SYSTEM-level privileges, enabling it to encrypt files across the system.
To complete the encryption process, the ransomware uses the Windows Restart Manager API to unlock files that are currently in use by active applications. After encryption, it appends the extensions . !NT3RLOCK or .int3R1Ock to the affected files.
Previous Targets and Victims
The Interlock ransomware operation has been active since 2024 and has already claimed responsibility for several high-profile attacks. Among the organizations allegedly targeted are the Texas Tech University System, the healthcare provider DaVita, Kettering Health, and the city government of Saint Paul in Minnesota.
Interlock was also one of the early ransomware groups known to adopt the ClickFix technique, later expanding its tactics to include a variation known as FileFix, which further improves the effectiveness of social engineering during the initial infection stage.
These techniques demonstrate how ransomware operators continue to evolve their attack methods to exploit both human behavior and technological vulnerabilities.
What Undercode Say:
The emergence of Slopoly is an important signal for the cybersecurity industry because it represents an early but clear example of AI-assisted malware development being used in real-world ransomware operations. While the malware itself is technically simple, the implications of its creation method are far more significant than its capabilities.
Generative AI tools can dramatically reduce the barrier to entry for cybercriminals. Instead of requiring advanced programming skills, attackers can potentially describe the functionality they want and receive working code within seconds. This changes the economics of cybercrime by enabling faster experimentation, rapid malware iteration, and automated customization for different victims.
The Slopoly script demonstrates this shift clearly. The structured comments, clean variable names, and organized logging functions are typical outputs of AI-assisted code generation. Ironically, these characteristics make the malware easier for analysts to read but also easier for attackers to produce.
Another key observation is the concept of builder-based malware generation. If Slopoly was generated through a builder that randomizes configuration values and function names, attackers could quickly create thousands of slightly different versions of the same malware. This tactic significantly complicates signature-based detection systems used by many security tools.
The attack also reinforces a broader trend: ransomware groups are evolving into full-scale cybercrime platforms. Instead of relying on a single piece of malware, they deploy layered attack chains that include loaders, backdoors, persistence tools, reconnaissance scripts, and encryption payloads. Slopoly appears to serve primarily as a communication bridge within that larger ecosystem.
Another interesting point is the combination of simple malware with sophisticated attack strategies. The code itself is not advanced, but when integrated with social engineering techniques like ClickFix and supported by ransomware payloads, it becomes part of a highly effective intrusion framework.
This strategy reflects a modern cybercrime principle: attackers do not need complex malware if their operational workflow is efficient and adaptable. A simple backdoor combined with stealthy persistence and remote control is often enough to achieve the attacker’s objectives.
Looking ahead, the real concern is not Slopoly itself but the potential future evolution of AI-generated malware. As generative models improve, they may be capable of creating far more advanced malicious tools, including automated obfuscation techniques, adaptive evasion mechanisms, and autonomous attack workflows.
If this trend continues, defenders may face an environment where malware variants are generated dynamically, customized for each target, and updated faster than traditional security detection methods can adapt.
Fact Checker Results
✅ IBM researchers did analyze the Slopoly malware and identified signs of AI-assisted code generation.
✅ The malware was used in attacks connected to the Interlock ransomware campaign.
❌ The exact generative AI tool or model used to create the malware has not been confirmed.
Prediction
🔮 AI-assisted malware development will likely become common among ransomware groups within the next few years.
🔮 Malware builders powered by generative models could allow attackers to produce thousands of unique variants automatically.
🔮 Cybersecurity defenses will increasingly rely on behavioral detection rather than signature-based methods to counter AI-generated threats.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://stackoverflow.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
