Hive0163 is a financially motivated criminal group tracked by IBM X-Force that emerged as an operator of the Interlock ransomware in September 2024. The group is distinguished by its direct operation model, eschewing the Ransomware-as-a-Service (RaaS) platform commonly used by rivals, and instead leveraging a large custom toolkit. In early 2026, Hive0163 gained notoriety for being among the first to experiment with AI-generated malware, specifically the Slopoly backdoor, in live ransomware attacks, demonstrating a pioneering but technically mediocre application of artificial intelligence in cybercriminal operations. While IBM X-Force notes a suspected relationship or lineage between Hive0163 and the Rhysida ransomware group, Hive0163 maintains distinct campaigns and utilizes its own unique suite of tools. The group's primary objective is extortion through large-scale data exfiltration and ransomware deployment, making them a significant threat in the cyber landscape due to their innova