Malware
Slopoly
According to IBM X-Force, Slopoly is a likely LLM-generated PowerShell-based command-and-control framework that functions as a fully functional backdoor, collecting system information and sending it a
Slopoly is a PowerShell malware family operated by Hive0163.
Background
IBM X-Force assesses Slopoly to be a probably LLM-generated, PowerShell-based command-and-control framework that operates as a complete backdoor: it gathers system information and ships it as JSON to a C2 server through HTTP POST heartbeats while polling for commands to run in the system shell. Tell-tale signs of AI authorship are present, including abundant comments, logging, error handling, and descriptive variable names, yet it relies on no sophisticated techniques and, despite being branded polymorphic, cannot truly rewrite its own code. Persistence is achieved via a scheduled task, and a rotating log file is kept, giving the operator prolonged access to the compromised server. The overall quality points to a less capable large language model, and the Hive0163 threat actor deployed it in the later phases of a ransomware attack.
Source: Malpedia (Fraunhofer FKIE).