3AM Ransomware Affiliate Hits UK School Network in Suspected AI-Assisted Attack
A 3AM ransomware affiliate compromised a UK school estate, encrypting roughly 37 of nearly 50 machines reached from a single unmanaged host, according to Bitdefender researchers. The attack unfolded between September 10-19, though the initial access vector was not determined. Bitdefender believes the attacker may have used AI-generated commands in an agentic loop, based on repeated, slightly modified commands issued at regular 40-100 second intervals, though they could not confirm which model or whether a human was involved.
Detalhes técnicos
The attacker used a modified public PowerShell tool to extract and decrypt credentials from three Veeam backup servers, copied a Chrome credentials database, and deployed Mimikatz and LSASS memory-dumping tools. They mapped domain relationships, searched logon scripts for references to other schools, and created two backdoor domain admin accounts named 'library' and 'svc_bkpmon'. After stealing financial data, they configured two-way trusts between three previously separate Active Directory domains to expand reach. In the final stage, they attempted to remove Sophos and Bitdefender endpoint protection, deleted system-state backups, and deployed 3AM's Rust-based encryptor, succeeding on about 37 hosts. 3AM emerged in 2023 after LockBit's takedown and has been linked to former Conti and Royal ransomware operators; affiliates have previously used email bombing and spoofed IT support calls for initial access. A prior notable victim is Kootenai Health, where an August 2024 attack exposed data on over 464,000 patients.
Remediação
The UK's NCSC separately published its 'State of the Cyber Nation' report the same day, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.
Linha do tempo
-
3AM Ransomware Affiliate Hits UK School Network in Suspected AI-Assisted Attack
ler a análise desta fonte ocultar
A 3AM ransomware affiliate compromised a UK school estate, encrypting roughly 37 of nearly 50 machines reached from a single unmanaged host, according to Bitdefender researchers. The attack unfolded between September 10-19, though the initial access vector was not determined. Bitdefender believes the attacker may have used AI-generated commands in an agentic loop, based on repeated, slightly modified commands issued at regular 40-100 second intervals, though they could not confirm which model or whether a human was involved.
Technical Details
The attacker used a modified public PowerShell tool to extract and decrypt credentials from three Veeam backup servers, copied a Chrome credentials database, and deployed Mimikatz and LSASS memory-dumping tools. They mapped domain relationships, searched logon scripts for references to other schools, and created two backdoor domain admin accounts named 'library' and 'svc_bkpmon'. After stealing financial data, they configured two-way trusts between three previously separate Active Directory domains to expand reach. In the final stage, they attempted to remove Sophos and Bitdefender endpoint protection, deleted system-state backups, and deployed 3AM's Rust-based encryptor, succeeding on about 37 hosts. 3AM emerged in 2023 after LockBit's takedown and has been linked to former Conti and Royal ransomware operators; affiliates have previously used email bombing and spoofed IT support calls for initial access. A prior notable victim is Kootenai Health, where an August 2024 attack exposed data on over 464,000 patients.
Remediation
The UK's NCSC separately published its 'State of the Cyber Nation' report the same day, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.