AI-Generated Slopoly Malware Powers Interlock Ransomware

Hive0163 Deploys AI-Created Slopoly in Ransomware Campaign

Security researchers discovered a new malware strain called Slopoly that appears to be generated using artificial intelligence tools. The malware enabled attackers to maintain persistent access to compromised servers for over a week during Interlock ransomware operations.

The Hive0163 threat group deployed Slopoly as part of a sophisticated attack chain that combined AI-assisted malware development with traditional ransomware tactics. The Hacker News reported the discovery on March 12, 2026, highlighting the emerging trend of AI-powered cybercrime tools.

Enterprise Servers Targeted in Multi-Stage Attacks

The attacks primarily targeted enterprise servers running Windows systems. Organizations across multiple sectors experienced prolonged network compromise, with attackers maintaining access for extended periods before deploying the final ransomware payload.

The extended dwell time allowed threat actors to conduct thorough reconnaissance, escalate privileges, and exfiltrate sensitive data before encryption. This approach maximizes both the operational impact and potential ransom demands.

AI Tools Enable Rapid Malware Development

Slopoly demonstrates how generative AI can accelerate malware creation and customization. The malware's code structure and evasion techniques suggest automated generation rather than traditional manual development.

Security teams should monitor for unusual persistence mechanisms and extended network activity patterns. The combination of AI-generated tools with established ransomware operations represents a significant evolution in threat actor capabilities and operational efficiency.