Ledger / Feb 2026
Slopoly: likely AI-generated PowerShell backdoor in Hive0163 ransomware attack
Strong
IBM X-Force infers AI generation from comments and code style and could not identify the model.
X-Force found a technically mediocre PowerShell C2 client during a live ransomware response, with clear variable names and detailed comments that looked machine-written. They say it shows AI speeding up malware development.
“IBM X-Force discovered a likely AI-generated novel malware which we are dubbing “Slopoly,” used during a ransomware attack.”IBM X-Force
Sources
- A Slopoly start to AI-enhanced ransomware attacksIBM X-Force · 12 Mar 2026 · primary source
- Date
- Feb 2026
- Disclosed
- 12 Mar 2026
- Actor
- Hive0163 (criminal), as attributed by IBM X-Force
- Targets
- Enterprise victim of ClickFix-initiated ransomware intrusion
- What the AI did
- Malware dev
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- unknown
- Autonomy
- assist
- Outcome
- Backdoor gave persistent access for more than a week during a ransomware engagement.