Bitdefender Sees Signs of Possible AI-Assisted Loops in 3AM Attack on UK School

Summary

Bitdefender says a 3AM affiliate’s attack on a UK school showed signs of an AI system handling repetitive commands and troubleshooting. Researchers could not access the attacker’s machine to verify AI use.

Key points

Bitdefender reported that attackers stole backup credentials, created rogue domain-admin accounts, established Active Directory trusts, moved between schools, stole data, and deployed 3AM ransomware.
The attackers reportedly used Windows tools and scripts, including PowerShell, WMI, Mimikatz, and a previously published Veeam script.
Bitdefender inferred possible agentic-loop activity from repeated command attempts, numbered script revisions, confirmation files, and apparent errors using Veeam’s web interface.
Researchers said task timing appeared consistent with a human choosing actions while a model handled retries, but they could not access the attacker’s machine or document the AI model itself.
The vendor recommended separating domain admin credentials, protecting backups, restricting remote execution and administrative shares, blocking unnecessary shells, and deploying endpoint security on every machine.

Article Details

Event Type: Ransomware attack against a UK school estate, with Bitdefender assessing that an AI system may have assisted a human operator with repetitive command generation and troubleshooting.
Impact: Attackers reportedly stole backup credentials and data, created rogue domain-admin accounts, established trusts between previously separate Active Directory domains, moved between schools, and deployed 3AM ransomware. Bitdefender could not access the attacker's machine or document direct evidence of an AI model, so AI involvement remains an assessment rather than a confirmed capability.