cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

UK School Estate Hit by 3AM Ransomware in Suspected AI-Assisted Attack

· Original article ↗

Summary

Bitdefender says a 3AM affiliate encrypted about 37 machines at a UK school estate after stealing credentials and moving across three Active Directory domains. Repeated commands suggested possible AI assistance, but this was not confirmed.

Key points

  • The activity occurred September 10–19; Bitdefender could not establish the initial access method.
  • The attacker used a modified public PowerShell tool to extract credentials from three Veeam backup servers, copied a Chrome credentials database, and deployed Mimikatz and LSASS memory-dumping tools.
  • The attacker mapped domain relationships, searched logon-script folders for other schools, and created two backdoor domain administrator accounts.
  • After stealing financial data, the attacker configured two-way trusts between three previously separate Active Directory domains.
  • The attacker attempted to remove Sophos and Bitdefender protection and delete system-state backups; 3AM ransomware encrypted about 37 of nearly 50 reachable machines.
  • Bitdefender observed slightly modified commands issued at regular intervals, suggesting possible AI-generated commands or an agentic loop. Researchers could not determine whether AI was used or identify a model.

Article Details

Victim Organization
Not disclosed
Victim Domain
Not disclosed
Incident Type
Ransomware attack and data theft
Disclosure Date
2026-11-03
Data Types Exposed
  • Financial data
  • Credentials
Affected Records
Not disclosed
Affected Data Size
Not disclosed
Operational Impact
The attacker encrypted approximately 37 of nearly 50 reachable machines. They also attempted to remove Sophos and Bitdefender protection and delete system-state backups. Bitdefender could not establish the initial access method. Researchers suspected AI-assisted commands and an automated agentic loop but could not verify the model or how it was used.
Ransom Or Extortion
No ransom demand or extortion activity was reported; the attacker deployed the 3AM encryptor.
Claim Status
confirmed

MITRE ATT&CK

T1003.001 · LSASS MemoryThe attacker deployed Mimikatz and LSASS memory-dumping tools.T1059.001 · PowerShellA modified public PowerShell tool was used to extract and decrypt credentials from Veeam backup servers.T1136.002 · Domain AccountThe attacker created two backdoor domain administrator accounts.T1482 · Domain Trust DiscoveryThe attacker mapped relationships between domains.T1484.002 · Trust ModificationThe attacker configured two-way trusts between three Active Directory domains.T1486 · Data Encrypted for ImpactThe attacker deployed the 3AM encryptor, encrypting approximately 37 machines.T1490 · Inhibit System RecoveryThe attacker attempted to delete system-state backups.T1555.003 · Credentials from Web BrowsersThe attacker copied a Chrome database containing credentials.T1562.001 · Disable or Modify ToolsThe attacker attempted to remove Sophos and Bitdefender protection from reachable hosts.

Threat Actors

3AMA 3AM ransomware affiliate targeted the UK school estate and deployed the 3AM encryptor. Bitdefender suspected possible AI-assisted activity but could not verify the model or its use.

Malware

3amUK school estate hit by 3AM ransomware in suspected AI-assisted attack

Vendors

BitdefenderResearchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.SophosIn the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor.VeeamThe threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS

Products

BitdefenderResearchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.Google Chromepublic PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.SophosIn the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor.VeeamThe threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS

Tools

Mimikatzstored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.

Countries

United KingdomUK school estate hit by 3AM ransomware in suspected AI-assisted attack

Related Articles