Overview
Bitdefender has detailed an intrusion at a UK school estate in which a 3AM ransomware affiliate encrypted around 37 of nearly 50 machines reachable from an unmanaged host. The researchers suspect the attacker used AI-generated commands in an automated, agentic loop, though they could not access the attacker's machine and cannot confirm which model was used, whether it ran locally or remotely, or whether a human relayed commands and results.
Malicious activity ran from September 10 to 19. The initial access method was not determined.
Why Researchers Suspect AI Assistance
- Commands were repeated with slight modifications
- Commands arrived at consistent intervals of roughly 40 to 100 seconds
Bitdefender notes that threat actors are experimenting heavily with AI tooling, regardless of how much AI was actually involved here.
Attack Chain
| Stage | Activity |
|---|---|
| Credential theft | Modified public PowerShell tool used to extract and decrypt credentials from three Veeam backup servers; Chrome credential database copied |
| Credential dumping | Mimikatz and LSASS memory-dumping tools deployed |
| Discovery | Domain relationships mapped; logon-script folders searched for references to other schools |
| Persistence | Two backdoor domain administrator accounts created, named library and svc_bkpmon |
| Expansion | Two-way trusts configured between three previously separate Active Directory domains |
| Data theft | Financial data stolen |
| Impact | Attempts to disable Sophos and Bitdefender protection, delete system-state backups, then deploy the Rust-based 3AM encryptor on about 37 machines |
About 3AM Ransomware
3AM surfaced in 2023, after an attacker used it when a LockBit deployment was blocked. Researchers have linked the operation to the Conti and Royal ransomware gangs. Affiliates have previously used email bombing and spoofed IT-support calls for access. A past victim, Kootenai Health, had data on more than 464,000 patients exposed in an August 2024 attack.
The UK NCSC's "State of the Cyber Nation" report urges critical infrastructure operators to prepare for AI-powered ransomware attacks by 2028.
Defensive Takeaways
- Protect backup servers. Veeam credential stores were an early target; isolate backup infrastructure and restrict who can read stored credentials.
- Inventory unmanaged hosts. The attack pivoted from a host outside management; unmanaged devices on school networks are a blind spot.
- Alert on new domain admins and domain trusts. Both were used here and are high-signal events.
- Monitor for tamper attempts against EDR and for deletion of system-state backups.
- Hunt for rapid, repetitive command sequences at steady intervals, which may indicate automated operators.
- Keep offline or immutable backups that cannot be reached with domain credentials.