3AM Ransomware Affiliate Used Hybrid Human-AI Tactics to Compromise UK School Estate
Bitdefender investigated a 3AM ransomware intrusion against a UK school estate that occurred between September 10-19, 2026, resulting in the encryption of 37 machines out of 50 accessed. The investigation found that the attacker combined manual keyboard operation with AI-agent-driven command execution, which Bitdefender describes as the first documented case of this hybrid approach in Europe. The attacker stole backup infrastructure credentials, moved laterally via WMI and PowerShell/wmic, deployed Mimikatz for credential dumping, created backdoor domain-administrator accounts, exfiltrated financial files via an unusual registry-based HTTP POST channel, and established cross-domain trusts to spread access before disabling EDR and deploying the ransomware payload.
Detalhes técnicos
Initial access could not be determined. On September 10, attackers accessed and decrypted stored backup credentials using the Windows Data Protection API. Between September 12-13, lateral movement testing occurred via WMI commands issued from a host where SQL Server was the parent process; command timing patterns (41-101 second retries vs. 2-16 minute gaps between new tasks) indicated an AI agent handled rapid iterative retries while a human operator set higher-level goals. On September 14, the attacker ran Mimikatz and created two backdoor domain-admin accounts via separate methods, then exfiltrated 40 financial files using robocopy and an HTTP POST to a C2 endpoint, with a registry-as-transport channel flagged as an unusual and notable indicator. On September 19, the attacker joined three Active Directory domains with two-way trusts within a roughly three-hour window, reaching 50 machines from an unmanaged host, before removing EDR tools and encrypting 37 machines.
Remediação
Bitdefender recommends keeping administrative accounts for separate domains isolated and never storing privileged credentials for multiple domains together, treating backup infrastructure as a high-value target with monitoring for malicious access, restricting remote execution and administrative shares, blocking interpreters/shells on machines that don't need them, and deploying endpoint agents on every machine.
Linha do tempo
-
3AM Ransomware Affiliate Used Hybrid Human-AI Tactics to Compromise UK School Estate
ler a análise desta fonte ocultar
Bitdefender investigated a 3AM ransomware intrusion against a UK school estate that occurred between September 10-19, 2026, resulting in the encryption of 37 machines out of 50 accessed. The investigation found that the attacker combined manual keyboard operation with AI-agent-driven command execution, which Bitdefender describes as the first documented case of this hybrid approach in Europe. The attacker stole backup infrastructure credentials, moved laterally via WMI and PowerShell/wmic, deployed Mimikatz for credential dumping, created backdoor domain-administrator accounts, exfiltrated financial files via an unusual registry-based HTTP POST channel, and established cross-domain trusts to spread access before disabling EDR and deploying the ransomware payload.
Technical Details
Initial access could not be determined. On September 10, attackers accessed and decrypted stored backup credentials using the Windows Data Protection API. Between September 12-13, lateral movement testing occurred via WMI commands issued from a host where SQL Server was the parent process; command timing patterns (41-101 second retries vs. 2-16 minute gaps between new tasks) indicated an AI agent handled rapid iterative retries while a human operator set higher-level goals. On September 14, the attacker ran Mimikatz and created two backdoor domain-admin accounts via separate methods, then exfiltrated 40 financial files using robocopy and an HTTP POST to a C2 endpoint, with a registry-as-transport channel flagged as an unusual and notable indicator. On September 19, the attacker joined three Active Directory domains with two-way trusts within a roughly three-hour window, reaching 50 machines from an unmanaged host, before removing EDR tools and encrypting 37 machines.
Remediation
Bitdefender recommends keeping administrative accounts for separate domains isolated and never storing privileged credentials for multiple domains together, treating backup infrastructure as a high-value target with monitoring for malicious access, restricting remote execution and administrative shares, blocking interpreters/shells on machines that don't need them, and deploying endpoint agents on every machine.