UK School Estate Hit by 3AM Ransomware in Suspected AI-Assisted Attack

A 3AM ransomware affiliate encrypted around 37 of nearly 50 machines it reached at a school estate in the UK, according to researchers at cybersecurity company Bitdefender. The machines were accessed from an unmanaged host.

Bitdefender says the attacker may have used AI-generated commands and an automated agentic loop. Researchers observed repeated commands, slightly modified with each attempt and issued roughly every 40 to 100 seconds. They could not access the machine used by the attacker, so they could not establish which language model, if any, was involved, where it ran, or whether a person transferred instructions and results manually.

The activity took place between September 10 and 19. Bitdefender could not determine how the attacker first gained access. The affiliate used a modified public PowerShell tool to extract and decrypt credentials from three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.

After mapping domain relationships and searching logon-script folders for references to other schools, the attacker created two backdoor domain administrator accounts named “library” and “svc_bkpmon.” The affiliate stole financial data and configured two-way trusts among three previously separate Active Directory domains to expand access.

In the attack’s final stage, the attacker tried to remove Sophos and Bitdefender protection, delete system-state backups, and deploy 3AM’s Rust-based encryptor. Bitdefender says encryption succeeded on around 37 machines. The observations suggest possible AI involvement, but do not establish that AI was used.