3AM ransomware affiliate encrypts ~37 systems at UK school estate in suspected AI-assisted attack, per Bitdefender

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 04/11/2026 09:00 · coletado 04/11 09:00

   3AM Ransomware Affiliate Used Hybrid Human-AI Tactics to Compromise UK School Estate

   ler a análise desta fonte ocultar

   Bitdefender investigated a 3AM ransomware intrusion against a UK school estate that occurred between September 10-19, 2026, resulting in the encryption of 37 machines out of 50 accessed. The investigation found that the attacker combined manual keyboard operation with AI-agent-driven command execution, which Bitdefender describes as the first documented case of this hybrid approach in Europe. The attacker stole backup infrastructure credentials, moved laterally via WMI and PowerShell/wmic, deployed Mimikatz for credential dumping, created backdoor domain-administrator accounts, exfiltrated financial files via an unusual registry-based HTTP POST channel, and established cross-domain trusts to spread access before disabling EDR and deploying the ransomware payload.

   Technical Details

   Initial access could not be determined. On September 10, attackers accessed and decrypted stored backup credentials using the Windows Data Protection API. Between September 12-13, lateral movement testing occurred via WMI commands issued from a host where SQL Server was the parent process; command timing patterns (41-101 second retries vs. 2-16 minute gaps between new tasks) indicated an AI agent handled rapid iterative retries while a human operator set higher-level goals. On September 14, the attacker ran Mimikatz and created two backdoor domain-admin accounts via separate methods, then exfiltrated 40 financial files using robocopy and an HTTP POST to a C2 endpoint, with a registry-as-transport channel flagged as an unusual and notable indicator. On September 19, the attacker joined three Active Directory domains with two-way trusts within a roughly three-hour window, reaching 50 machines from an unmanaged host, before removing EDR tools and encrypting 37 machines.

   Remediation

   Bitdefender recommends keeping administrative accounts for separate domains isolated and never storing privileged credentials for multiple domains together, treating backup infrastructure as a high-value target with monitoring for malicious access, restricting remote execution and administrative shares, blocking interpreters/shells on machines that don't need them, and deploying endpoint agents on every machine.

2. gbhackers.com ↗ · pub. 04/11/2026 08:28 · coletado 04/11 09:00

   3AM Ransomware Affiliate Breaches UK School Network, AI-Assisted Execution Suspected

   ler a análise desta fonte ocultar

   Bitdefender investigated a 3AM ransomware (ThreeAM) intrusion into a UK school network affecting 47 systems, including roughly 21 servers and eight domain controllers. The affiliate used standard living-off-the-land techniques combined with public tools (Mimikatz, Impacket-style utilities, a modified Veeam credential-recovery script), but command patterns—repeated commands with short, consistent revision intervals, incorrect Veeam API assumptions, and Unix-style syntax in Windows commands—suggest a human operator may have been assisted by a large language model in an agentic loop. Researchers stress this remains a hybrid-workflow hypothesis, not proof of fully autonomous AI-driven ransomware. The initial access vector is unknown, and the external C2 host used for exfiltration could not be examined, limiting attribution of any AI tooling.

   Technical Details

   Activity began September 13 with credential theft from three backup servers via a modified script querying Veeam databases and decrypting secrets with Windows DPAPI. The attacker exfiltrated Chrome's credential database, exported registry hives, and deployed Mimikatz disguised as sysmon64.exe. Two rogue domain-admin accounts (library, svc_bkpmon) provided redundant persistence. On September 15, finance documents were staged as Base64-encoded registry values and an archive was uploaded via HTTP POST to an unmanaged internal host also used as C2. On September 18, the attacker established two-way trusts linking three domains. On September 19, attempts to disable endpoint protection failed due to anti-tampering, but a loader reached ~40 machines before the Rust-based ThreeAM encryptor ran between 05:07–05:33 UTC, deleting system-state backups during deployment.

   Remediation

   Defenders should monitor for unexpected Active Directory domain trust creation, privileged account creation, backup credential access, registry-hive exports, and unusual registry-based file staging, and maintain robust identity, endpoint, and network telemetry to detect these familiar techniques regardless of AI involvement.

3. hackread.com ↗ · pub. 03/11/2026 13:10 · coletado 03/11 14:01

   3AM Ransomware Affiliate Breaches UK School Network, Encrypts 37 Systems in Suspected AI-Assisted Attack

   ler a análise desta fonte ocultar

   Bitdefender investigated what it describes as possibly Europe's first ransomware incident involving suspected AI-driven command retries alongside a human operator. The intrusion targeted a UK school estate comprising 47 systems across separate Active Directory domains, resulting in encryption of roughly 37 machines by a 3AM (ThreeAM) ransomware affiliate. The attack combined living-off-the-land techniques with public tools like Mimikatz and Impacket-style remote execution, and showed command retry patterns (40–101 seconds) consistent with a possible agentic AI loop feeding results back to a language model. Bitdefender could not confirm whether the loop was fully automated or operator-driven, but notes the damage stemmed from conventional weaknesses: credential theft, domain trust abuse, and backup compromise.

   Technical Details

   The affiliate stole backup credentials on September 10–11 using scripts that decrypted stored passwords via Windows DPAPI and harvested browser credentials. Mimikatz was downloaded on September 12 and renamed to sysmon64.exe. On September 14, the attacker dumped registry hives and created backdoor admin accounts named library and svc_bkpmon. On September 15, data from a finance share was staged in registry values and exfiltrated via an unmanaged machine acting as C2 infrastructure. On September 18, dnscmd was used to create DNS conditional forwarders and netdom established two-way domain trusts; diagnostic scripts (wb_probe) ran trust-verification commands, and Netlogon was restarted. A scheduled PowerShell task propagated the backdoor account to roughly 40 machines. On September 19, attempts to disable Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls; the attacker then deployed a script loader before executing the Rust-based 3AM encryptor, which encrypted about 37 systems and deleted system-state backups using wbadmin.

   Remediation

   Bitdefender recommends segmenting privileged accounts across domains, monitoring for newly created domain trusts, hardening backup infrastructure, and ensuring full endpoint protection coverage across all systems.

4. darkreading.com ↗ · pub. 03/11/2026 11:00 · coletado 03/11 12:00 só resumo do feed

   3AM Ransomware Affiliate Uses AI-Like Command Loops in European School Network Breach

   ler a análise desta fonte ocultar

   A 3AM ransomware affiliate compromised a European school's network, and researchers found evidence suggesting a large language model may have generated and iteratively revised attacker commands during the intrusion. The behavior resembled agentic, loop-style command generation rather than typical manually scripted attacker activity, though researchers stopped short of confirming full automation of the attack chain. The finding adds to a growing body of observations about threat actors experimenting with AI tooling to assist in post-compromise operations such as reconnaissance, command crafting, and evasion. Specific technical indicators, victim identity, and the exact AI tooling involved were not disclosed in detail.

   Technical Details

   Researchers observed command sequences and revisions during the breach consistent with an AI model iterating on attacker instructions, a pattern described as "AI-like loops." The attack is attributed to an affiliate of the 3AM ransomware operation targeting a school in Europe, though the report does not specify the exact ransom demand, data exfiltrated, or the initial access vector used.

5. bleepingcomputer.com ↗ · pub. 03/11/2026 11:00 · coletado 03/11 12:00 primeiro registro

   3AM Ransomware Affiliate Hits UK School Network in Suspected AI-Assisted Attack

   ler a análise desta fonte ocultar

   A 3AM ransomware affiliate compromised a UK school estate, encrypting roughly 37 of nearly 50 machines reached from a single unmanaged host, according to Bitdefender researchers. The attack unfolded between September 10-19, though the initial access vector was not determined. Bitdefender believes the attacker may have used AI-generated commands in an agentic loop, based on repeated, slightly modified commands issued at regular 40-100 second intervals, though they could not confirm which model or whether a human was involved.

   Technical Details

   The attacker used a modified public PowerShell tool to extract and decrypt credentials from three Veeam backup servers, copied a Chrome credentials database, and deployed Mimikatz and LSASS memory-dumping tools. They mapped domain relationships, searched logon scripts for references to other schools, and created two backdoor domain admin accounts named 'library' and 'svc_bkpmon'. After stealing financial data, they configured two-way trusts between three previously separate Active Directory domains to expand reach. In the final stage, they attempted to remove Sophos and Bitdefender endpoint protection, deleted system-state backups, and deployed 3AM's Rust-based encryptor, succeeding on about 37 hosts. 3AM emerged in 2023 after LockBit's takedown and has been linked to former Conti and Royal ransomware operators; affiliates have previously used email bombing and spoofed IT support calls for initial access. A prior notable victim is Kootenai Health, where an August 2024 attack exposed data on over 464,000 patients.

   Remediation

   The UK's NCSC separately published its 'State of the Cyber Nation' report the same day, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.