UK school estate hit by 3AM ransomware in suspected AI-assisted attack

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.

Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.

The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds.

"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," Bitdefender explains.

The researchers note that they could only document the behavior, and it looked similar to an agentic loop.

The malicious activity spanned between September 10 and19, but Bitdefender could not establish the attacker's initial access method.

The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.

They mapped domain relationships and searched logon-script folders for references to other schools, eventually creating two backdoor domain administrator accounts named 'library' and 'svc_bkpmon.'

After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach.

In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM's Rust-based encryptor. They succeeded in about 37 cases.

The 3AM ransomware threat emerged in 2023 and came to public attention when an attacker deployed its Rust-based ransomware after LockBit was blocked.

Researchers later linked the operation to the Conti and Royal ransomware gangs, and affiliates have been observed using email bombing and spoofed IT support calls to access corporate networks.

A notable past victim is Kootenai Health, where an August 2024 attack exposed personal information belonging to more than 464,000 patients.

Regardless of the current level of AI tool involvement in 3AM attacks, Bitdefender's observations suggest the threat actors appear to be experimenting with them heavily.

Earlier today, the NCSC in the UK published this year's 'The State of the Cyber Nation' report, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.