Bitdefender details human-AI hybrid 3AM ransomware attack on UK schools
A 3AM ransomware affiliate compromised a UK school estate between September 10 and 19, 2026, encrypting 37 of 50 machines reached, according to a Bitdefender investigation published November 3. The report describes a hybrid operation, with a human choosing steps and an AI model handling command retries, Veeam backup credential theft and exfiltration of 40 financial files; initial access remains unknown. Bitdefender recommends separating admin accounts per domain, protecting backup infrastructure and putting an endpoint agent on every machine.
What happened
A ransomware intrusion hit a UK school estate between September 10 and 19, 2026. A 3AM group affiliate encrypted 37 machines and stole 40 financial files, according to a Bitdefender investigation published November 3. Bitdefender assesses that a human set the goals while an AI model handled the mechanical work.
Why it matters
Teaching machines stopped and financial data left the institution. Starting from one unmanaged host, the attacker reached 50 machines and linked three network domains, indicating broad compromise of the estate. Bitdefender expects hybrid attacks like this to become more common in 2027.
What to do
Review domain administrator accounts and remove unnecessary two-way trusts between domains. Audit credentials stored in backup infrastructure and treat that environment as a target. Put an endpoint agent on every machine, including currently unmanaged hosts.
For the technical team
- Affected
- Rede de escolas no Reino Unido atingida por ransomware 3AM · A UK school estate; no specific product or version named in the sources.
- Exploitation
- Incident ran September 10 to 19, 2026, documented by Bitdefender in a November 3 blog and attributed to a 3AM ransomware affiliate. 37 of the 50 machines reached were encrypted. BleepingComputer describes it as a suspected AI-assisted attack.
- Fix
- No software fix (network intrusion). Bitdefender mitigations: keep administrative accounts of separate domains separate and never store privileged credentials for several domains in one place; review the backup strategy for malicious intent; restrict remote execution and administrative shares; block interpreters and shells on machines that never use them; put an endpoint agent on every machine.
- Vector
- Initial access undetermined by Bitdefender; the intrusion started from an unmanaged host. Credentials stored in the backup infrastructure (Veeam servers, per DarkWebInformer) were decrypted with the Windows Data Protection API. Lateral movement via WMI with stolen administrator credentials, from a machine where SQL Server was the parent process.
- More details
- 3AM is a ransomware-as-a-service operation; its Rust-based encryptor was first observed in February 2023, per Infosecurity. Bitdefender calls this the first case of its kind documented in Europe. Command pattern: retries changed at 40 to 101 second intervals point to an AI agent; minutes between tasks point to a human. Tools cited: Mimikatz, Chrome credential database copy and LSASS memory dumping (DarkWebInformer). 40 financial files copied with robocopy and exfiltrated via HTTP POST to a C2; the registry-as-transport channel was flagged as a hunting indicator. On September 14, two backdoor domain-administrator accounts were created. On September 19, three Active Directory domains were joined with two-way trusts in an approximately three-hour window. Attempts to remove EDR (Sophos and Bitdefender protection, per DarkWebInformer) and deletion of system-state backups before encryption. Bitdefender could not identify the AI model and cannot rule out a person copying data to a chatbot.
Timeline
Bitdefender details human-AI hybrid tactics in the September attack and confirms exfiltration of financial data.
Technical details emerge: about 37 systems encrypted between September 10 and 19, intrusion starting from an unmanaged host, credential theft from Veeam backups, and two backdoor domain admin accounts created.
Incident opened.
Sources 3 sources
- @BleepinComputer @BleepinComputer
- @DarkWebInformer @DarkWebInformer
- 3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compromise Infosecurity Magazine
