3AM Ransomware Hits UK School Estate, AI Use Suspected
Bitdefender documents a 3AM ransomware affiliate encrypting about 37 machines in a UK school estate. Command timing suggests automation. Confidence: low to moderate.
Morgan "airgap" ReyesEncryption confirmed. A 3AM ransomware affiliate encrypted about 37 of nearly 50 machines it reached in a UK school estate, BleepingComputer reported on November 3, citing Bitdefender research.
Activity window
Bitdefender places the intrusion between September 10 and 19. Initial access: unknown. Bitdefender could not establish it.
The attacker reached the estate from an unmanaged host. Bitdefender reports, in order:
- Credentials taken from three Veeam backup servers and from a browser credential database.
- Credential-dumping tools deployed.
- Domain relationships mapped, and logon-script folders searched for references to other schools.
- Two backdoor domain administrator accounts created: “library” and “svc_bkpmon.”
- Financial data stolen from compromised machines.
- Two-way trusts configured between three previously separate Active Directory domains.
- Attempts to remove Sophos and Bitdefender protection and to delete system-state backups.
- 3AM’s Rust-based encryptor deployed. About 37 hosts encrypted.
The AI claim
Bitdefender believes the operator may have used AI-generated commands in an automated loop. The basis: repeated commands, each slightly altered, issued at intervals of roughly 40 to 100 seconds.
Confidence: low to moderate. Bitdefender says it could not access the attacker’s machine. It cannot say which model was used, whether it ran locally or remotely, or whether a person was pasting instructions and results between the implant and a model. It documented behavior only, and the behavior resembles an agentic loop.
Analysis: timing regularity is consistent with automation but does not prove it. A scripted retry would look similar. The AI attribution remains unconfirmed.
Background
Per BleepingComputer, 3AM emerged in 2023. Its past victims include Kootenai Health, where an August 2024 attack exposed data on more than 464,000 patients.
The same day, the UK’s NCSC published its annual State of the Cyber Nation report, which urges critical infrastructure to prepare for AI-powered ransomware attacks by 2028, per BleepingComputer.
Related: NCSC expects AI-driven attacks on UK infrastructure by 2028, Chainalysis breach by an “agentic” attacker, and the ransomware hub.
Found this useful? Share it.
