IBM X-Force: Slopoly — First Confirmed AI-Generated Malware Framework Deployed by Hive0163 in Ransomware Campaign

IBM X-Force·high signal

IBM X-Force disclosed Slopoly, a C2 persistence client with hallmarks of LLM-generated code: extensive comments, verbose logging, descriptive variable names, and self-labeled 'Polymorphic C2 Persistence Client' despite no actual polymorphic behavior. Deployed by ransomware group Hive0163 via ClickFix social engineering, it maintained persistent server access for over a week. X-Force notes this signals a fundamental shift — AI-generated malware frameworks are now appearing in real attacks by financially motivated groups.