A 3AM ransomware affiliate targeted a school estate in the UK, encrypting around 37 of nearly 50 machines it reached from an unmanaged host, according to cybersecurity researchers at Bitdefender. The malicious activity took place between September 10 and 19, although researchers could not determine how the attacker first gained access.
Bitdefender said the operation may have involved AI-generated commands and an automated agentic loop. Researchers observed commands being repeated with small changes at intervals of roughly 40 to 100 seconds. However, they could not access the machine used by the attacker and therefore could not establish which language model, if any, was involved or whether a person relayed instructions and results between a model and the compromised systems.
During the intrusion, the attacker used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers. They also copied a Chrome database containing credentials and deployed Mimikatz and tools for dumping LSASS memory. After mapping relationships between domains and searching logon-script folders for references to other schools, the attacker created two backdoor domain administrator accounts named “library” and “svc_bkpmon.”
The attacker stole financial data from compromised machines and set up two-way trusts between three Active Directory domains that had previously been separate, expanding access across the school estate. In the final phase, they tried to remove Sophos and Bitdefender protections, delete system-state backups and deploy 3AM’s Rust-based encryptor. Encryption succeeded on about 37 machines.
Bitdefender said the activity resembles an agentic loop but stressed that it could document only the observed behavior, not confirm the use of AI. Its findings suggest 3AM affiliates may be experimenting with AI tools, though the extent of their role in this attack remains unclear.
Sources: BleepingComputer.