3AM Ransomware Affiliate Breaches UK School Network, AI-Assisted Execution Suspected
Bitdefender investigated a 3AM ransomware (ThreeAM) intrusion into a UK school network affecting 47 systems, including roughly 21 servers and eight domain controllers. The affiliate used standard living-off-the-land techniques combined with public tools (Mimikatz, Impacket-style utilities, a modified Veeam credential-recovery script), but command patterns—repeated commands with short, consistent revision intervals, incorrect Veeam API assumptions, and Unix-style syntax in Windows commands—suggest a human operator may have been assisted by a large language model in an agentic loop. Researchers stress this remains a hybrid-workflow hypothesis, not proof of fully autonomous AI-driven ransomware. The initial access vector is unknown, and the external C2 host used for exfiltration could not be examined, limiting attribution of any AI tooling.
Detalhes técnicos
Activity began September 13 with credential theft from three backup servers via a modified script querying Veeam databases and decrypting secrets with Windows DPAPI. The attacker exfiltrated Chrome's credential database, exported registry hives, and deployed Mimikatz disguised as sysmon64.exe. Two rogue domain-admin accounts (library, svc_bkpmon) provided redundant persistence. On September 15, finance documents were staged as Base64-encoded registry values and an archive was uploaded via HTTP POST to an unmanaged internal host also used as C2. On September 18, the attacker established two-way trusts linking three domains. On September 19, attempts to disable endpoint protection failed due to anti-tampering, but a loader reached ~40 machines before the Rust-based ThreeAM encryptor ran between 05:07–05:33 UTC, deleting system-state backups during deployment.
Remediação
Defenders should monitor for unexpected Active Directory domain trust creation, privileged account creation, backup credential access, registry-hive exports, and unusual registry-based file staging, and maintain robust identity, endpoint, and network telemetry to detect these familiar techniques regardless of AI involvement.
Linha do tempo
-
3AM Ransomware Affiliate Breaches UK School Network, AI-Assisted Execution Suspected
ler a análise desta fonte ocultar
Bitdefender investigated a 3AM ransomware (ThreeAM) intrusion into a UK school network affecting 47 systems, including roughly 21 servers and eight domain controllers. The affiliate used standard living-off-the-land techniques combined with public tools (Mimikatz, Impacket-style utilities, a modified Veeam credential-recovery script), but command patterns—repeated commands with short, consistent revision intervals, incorrect Veeam API assumptions, and Unix-style syntax in Windows commands—suggest a human operator may have been assisted by a large language model in an agentic loop. Researchers stress this remains a hybrid-workflow hypothesis, not proof of fully autonomous AI-driven ransomware. The initial access vector is unknown, and the external C2 host used for exfiltration could not be examined, limiting attribution of any AI tooling.
Technical Details
Activity began September 13 with credential theft from three backup servers via a modified script querying Veeam databases and decrypting secrets with Windows DPAPI. The attacker exfiltrated Chrome's credential database, exported registry hives, and deployed Mimikatz disguised as sysmon64.exe. Two rogue domain-admin accounts (library, svc_bkpmon) provided redundant persistence. On September 15, finance documents were staged as Base64-encoded registry values and an archive was uploaded via HTTP POST to an unmanaged internal host also used as C2. On September 18, the attacker established two-way trusts linking three domains. On September 19, attempts to disable endpoint protection failed due to anti-tampering, but a loader reached ~40 machines before the Rust-based ThreeAM encryptor ran between 05:07–05:33 UTC, deleting system-state backups during deployment.
Remediation
Defenders should monitor for unexpected Active Directory domain trust creation, privileged account creation, backup credential access, registry-hive exports, and unusual registry-based file staging, and maintain robust identity, endpoint, and network telemetry to detect these familiar techniques regardless of AI involvement.