3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack

Listen to this article

Press play to start listening

Cybersecurity firmBitdefenderhas investigated what it believes is Europe’s first ransomware incident involving a human operator and suspected AI-driven command retries.

In research shared with Hackread.com ahead of its publication, the cybersecurity firm detailed how a 3AM (ThreeAM) ransomware affiliate breached aUKschool estate with 47 systems across separate Active Directory domains and encrypted about 37 machines.

In itsblog post, published today, Bitdefender described the intrusion as “a hybrid operation in which some parts show a human operator at the keyboard while others behave like an agentic loop.” The suspected loop fed command results back to a language model, which then suggested alternative commands.

The timing supports that interpretation: key steps were minutes apart, while failed commands were retried every 40 to 101 seconds. However, Bitdefender could not confirm whether a model was running the loop automatically or whether an operator was copying commands and results between a terminal and anAItool.

The distinction matters. This was not a confirmed autonomous ransomware attack. The evidence points to possibleAI assistancewithin an operation that still relied on conventional intrusion techniques.

The affiliate mainly usedliving-off-the-landtechniques, relying on Windows tools such as PowerShell, WMI, netsh, reg and rundll32. It also used public tools, includingMimikatzand Impacket-style remote execution, alongside the 3AM encryptor. As Bitdefender noted, AI-enabled attacks do not need novel tools to succeed.

The attacker stole backup credentials on September 10 and 11 using scripts that decrypted stored passwords with Windows DPAPI and copied browser credentials. Mimikatz was downloaded on September 12, then renamed to sysmon64.exe. On September 14, the attacker dumped registry hives and created backdoor administrator accounts named library and svc_bkpmon.

On September 15, files from a finance share were staged in Windows registry values and transferred through an unmanaged machine used as command-and-control infrastructure.

On September 18, the attacker used dnscmd to create DNS conditional forwarders, then netdom to establish two-way trusts between separate domains. Diagnostic scripts, including wb_probe, ran trust-verification commands, but Bitdefender could not determine what the probes returned. Netlogon was restarted later that day. A scheduled PowerShell task then pushed the backdoor account’s access to about 40 machines.

The following day, attempts to remove Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls. The attacker deployed a script loader before running the Rust-based 3AM encryptor, which encrypted about 37 systems and deleted system-state backups with wbadmin.

The findings raise a practical concern for defenders. Even if AI helped troubleshoot the attack, the damage came through familiar weaknesses involving credentials, domain trust and backup protection, and Bitdefender expectshybrid attacksto become more common in 2027.

Researchers recommend that defenders should start separating privileged accounts across domains, monitoring new domain trusts, protecting backup infrastructure and ensuring every machine has endpoint protection.

Your email address will not be published.Required fields are marked*

Comment*

Name*

Email*

Website

Δ

Email Address*

FIRSTNAME

LASTNAME