Science & Tech · Cybersecurity · 2 hrs ago
UK school estate hit by 3AM ransomware in suspected AI-assisted attack
A 3AM ransomware affiliate attacked a school estate in the UK and moved between schools.
It encrypted about 37 of nearly 50 machines it reached from an unmanaged host.
The attackers also stole backup credentials and data, and used ordinary Windows tools to move between school networks.
Researchers said an AI system may have handled repetitive commands and retries, while a human chose the larger steps.
They could not access the attacker’s machine, so they could not confirm the AI system’s role directly.
The case matters because it suggests cybercriminals may combine human decisions with automated help, rather than relying only on people or AI.
A 3AM ransomware affiliate targeted a UK school estate and encrypted around 37 of nearly 50 machines reached from an unmanaged host.
The attackers stole backup credentials and created rogue domain-admin accounts.
They established trusts between previously separate Active Directory domains and moved between schools.
The attackers stole data and deployed 3AM ransomware.
Bitdefender assessed that an AI system may have handled repetitive command generation and troubleshooting while a human operator made high-level decisions.
- Who
- A 3AM ransomware affiliate targeted the school estate. Bitdefender investigated the attack.
- What
- The attackers stole credentials and data, moved between schools, and deployed ransomware. Around 37 machines were encrypted.
- When
- The sources do not state when the attack took place.
- Where
- A school estate in the UK.
- Why
- The sources do not state the attackers’ motive.
This story does not have two clearly opposing sides.
The attackers stole backup credentials and created rogue domain-admin accounts.
They established trusts between previously separate Active Directory domains and moved between schools.
They stole data and deployed 3AM ransomware, encrypting around 37 of nearly 50 machines reached from an unmanaged host.
- Ransomware affiliate
- 3AM
- Target
- A school estate in the UK
- Machines encrypted
- Around 37
- Machines reached
- Nearly 50
- Reported research
- Bitdefender
3 sources
What people are saying
The retries behave like a loop too.