AI-generated Slopoly malware used in Interlock ransomware attack

Slopoly is an AI-generated malware strain used as a PowerShell backdoor client for C2 frameworks. It was likely created using Large Language Models (LLM) as evidenced by extensive code commentary, structured logging, error handling, and clearly named variables. The malware deploys in C:\ProgramData\Microsoft\Windows\Runtime\ and functions include: collecting system information, sending heartbeat beacons every 30 seconds to /api/commands, polling for commands every 50 seconds, executing commands via cmd.exe, maintaining persistence.log files, and establishing persistence through a scheduled task named 'Runtime Broker'. It supports downloading and executing EXE/DLL/JavaScript payloads, running shell commands, changing beaconing intervals, updating itself, and process termination. The attack chain starts with ClickFix social engineering and deploys multiple components including NodeSnake and InterlockRAT backdoors. Interlock ransomware is a 64-bit Windows executable delivered via JunkFiction loader, running as SYSTEM scheduled task, using Windows Restart Manager API to release locked files and appending '.!NT3RLOCK' or '.int3R1Ock' extensions to encrypted files.