3AM ransomware affiliate encrypts ~37 systems at UK school estate in suspected AI-assisted attack, per Bitdefender

Linha do tempo

1. hackread.com ↗ · pub. 03/11/2026 13:10 · coletado 03/11 14:01

   3AM Ransomware Affiliate Breaches UK School Network, Encrypts 37 Systems in Suspected AI-Assisted Attack

   ler a análise desta fonte ocultar

   Bitdefender investigated what it describes as possibly Europe's first ransomware incident involving suspected AI-driven command retries alongside a human operator. The intrusion targeted a UK school estate comprising 47 systems across separate Active Directory domains, resulting in encryption of roughly 37 machines by a 3AM (ThreeAM) ransomware affiliate. The attack combined living-off-the-land techniques with public tools like Mimikatz and Impacket-style remote execution, and showed command retry patterns (40–101 seconds) consistent with a possible agentic AI loop feeding results back to a language model. Bitdefender could not confirm whether the loop was fully automated or operator-driven, but notes the damage stemmed from conventional weaknesses: credential theft, domain trust abuse, and backup compromise.

   Technical Details

   The affiliate stole backup credentials on September 10–11 using scripts that decrypted stored passwords via Windows DPAPI and harvested browser credentials. Mimikatz was downloaded on September 12 and renamed to sysmon64.exe. On September 14, the attacker dumped registry hives and created backdoor admin accounts named library and svc_bkpmon. On September 15, data from a finance share was staged in registry values and exfiltrated via an unmanaged machine acting as C2 infrastructure. On September 18, dnscmd was used to create DNS conditional forwarders and netdom established two-way domain trusts; diagnostic scripts (wb_probe) ran trust-verification commands, and Netlogon was restarted. A scheduled PowerShell task propagated the backdoor account to roughly 40 machines. On September 19, attempts to disable Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls; the attacker then deployed a script loader before executing the Rust-based 3AM encryptor, which encrypted about 37 systems and deleted system-state backups using wbadmin.

   Remediation

   Bitdefender recommends segmenting privileged accounts across domains, monitoring for newly created domain trusts, hardening backup infrastructure, and ensuring full endpoint protection coverage across all systems.

2. darkreading.com ↗ · pub. 03/11/2026 11:00 · coletado 03/11 12:00 só resumo do feed

   3AM Ransomware Affiliate Uses AI-Like Command Loops in European School Network Breach

   ler a análise desta fonte ocultar

   A 3AM ransomware affiliate compromised a European school's network, and researchers found evidence suggesting a large language model may have generated and iteratively revised attacker commands during the intrusion. The behavior resembled agentic, loop-style command generation rather than typical manually scripted attacker activity, though researchers stopped short of confirming full automation of the attack chain. The finding adds to a growing body of observations about threat actors experimenting with AI tooling to assist in post-compromise operations such as reconnaissance, command crafting, and evasion. Specific technical indicators, victim identity, and the exact AI tooling involved were not disclosed in detail.

   Technical Details

   Researchers observed command sequences and revisions during the breach consistent with an AI model iterating on attacker instructions, a pattern described as "AI-like loops." The attack is attributed to an affiliate of the 3AM ransomware operation targeting a school in Europe, though the report does not specify the exact ransom demand, data exfiltrated, or the initial access vector used.

3. bleepingcomputer.com ↗ · pub. 03/11/2026 11:00 · coletado 03/11 12:00 primeiro registro

   3AM Ransomware Affiliate Hits UK School Network in Suspected AI-Assisted Attack

   ler a análise desta fonte ocultar

   A 3AM ransomware affiliate compromised a UK school estate, encrypting roughly 37 of nearly 50 machines reached from a single unmanaged host, according to Bitdefender researchers. The attack unfolded between September 10-19, though the initial access vector was not determined. Bitdefender believes the attacker may have used AI-generated commands in an agentic loop, based on repeated, slightly modified commands issued at regular 40-100 second intervals, though they could not confirm which model or whether a human was involved.

   Technical Details

   The attacker used a modified public PowerShell tool to extract and decrypt credentials from three Veeam backup servers, copied a Chrome credentials database, and deployed Mimikatz and LSASS memory-dumping tools. They mapped domain relationships, searched logon scripts for references to other schools, and created two backdoor domain admin accounts named 'library' and 'svc_bkpmon'. After stealing financial data, they configured two-way trusts between three previously separate Active Directory domains to expand reach. In the final stage, they attempted to remove Sophos and Bitdefender endpoint protection, deleted system-state backups, and deployed 3AM's Rust-based encryptor, succeeding on about 37 hosts. 3AM emerged in 2023 after LockBit's takedown and has been linked to former Conti and Royal ransomware operators; affiliates have previously used email bombing and spoofed IT support calls for initial access. A prior notable victim is Kootenai Health, where an August 2024 attack exposed data on over 464,000 patients.

   Remediation

   The UK's NCSC separately published its 'State of the Cyber Nation' report the same day, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.