3AM Ransomware Affiliate Breaches UK School Network, Encrypts 37 Systems in Suspected AI-Assisted Attack
Bitdefender investigated what it describes as possibly Europe's first ransomware incident involving suspected AI-driven command retries alongside a human operator. The intrusion targeted a UK school estate comprising 47 systems across separate Active Directory domains, resulting in encryption of roughly 37 machines by a 3AM (ThreeAM) ransomware affiliate. The attack combined living-off-the-land techniques with public tools like Mimikatz and Impacket-style remote execution, and showed command retry patterns (40–101 seconds) consistent with a possible agentic AI loop feeding results back to a language model. Bitdefender could not confirm whether the loop was fully automated or operator-driven, but notes the damage stemmed from conventional weaknesses: credential theft, domain trust abuse, and backup compromise.
Detalhes técnicos
The affiliate stole backup credentials on September 10–11 using scripts that decrypted stored passwords via Windows DPAPI and harvested browser credentials. Mimikatz was downloaded on September 12 and renamed to sysmon64.exe. On September 14, the attacker dumped registry hives and created backdoor admin accounts named library and svc_bkpmon. On September 15, data from a finance share was staged in registry values and exfiltrated via an unmanaged machine acting as C2 infrastructure. On September 18, dnscmd was used to create DNS conditional forwarders and netdom established two-way domain trusts; diagnostic scripts (wb_probe) ran trust-verification commands, and Netlogon was restarted. A scheduled PowerShell task propagated the backdoor account to roughly 40 machines. On September 19, attempts to disable Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls; the attacker then deployed a script loader before executing the Rust-based 3AM encryptor, which encrypted about 37 systems and deleted system-state backups using wbadmin.
Remediação
Bitdefender recommends segmenting privileged accounts across domains, monitoring for newly created domain trusts, hardening backup infrastructure, and ensuring full endpoint protection coverage across all systems.
Linha do tempo
-
3AM Ransomware Affiliate Breaches UK School Network, Encrypts 37 Systems in Suspected AI-Assisted Attack
ler a análise desta fonte ocultar
Bitdefender investigated what it describes as possibly Europe's first ransomware incident involving suspected AI-driven command retries alongside a human operator. The intrusion targeted a UK school estate comprising 47 systems across separate Active Directory domains, resulting in encryption of roughly 37 machines by a 3AM (ThreeAM) ransomware affiliate. The attack combined living-off-the-land techniques with public tools like Mimikatz and Impacket-style remote execution, and showed command retry patterns (40–101 seconds) consistent with a possible agentic AI loop feeding results back to a language model. Bitdefender could not confirm whether the loop was fully automated or operator-driven, but notes the damage stemmed from conventional weaknesses: credential theft, domain trust abuse, and backup compromise.
Technical Details
The affiliate stole backup credentials on September 10–11 using scripts that decrypted stored passwords via Windows DPAPI and harvested browser credentials. Mimikatz was downloaded on September 12 and renamed to
sysmon64.exe. On September 14, the attacker dumped registry hives and created backdoor admin accounts namedlibraryandsvc_bkpmon. On September 15, data from a finance share was staged in registry values and exfiltrated via an unmanaged machine acting as C2 infrastructure. On September 18,dnscmdwas used to create DNS conditional forwarders andnetdomestablished two-way domain trusts; diagnostic scripts (wb_probe) ran trust-verification commands, and Netlogon was restarted. A scheduled PowerShell task propagated the backdoor account to roughly 40 machines. On September 19, attempts to disable Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls; the attacker then deployed a script loader before executing the Rust-based 3AM encryptor, which encrypted about 37 systems and deleted system-state backups usingwbadmin.Remediation
Bitdefender recommends segmenting privileged accounts across domains, monitoring for newly created domain trusts, hardening backup infrastructure, and ensuring full endpoint protection coverage across all systems.