UK school estate hit by 3AM ransomware in suspected AI-assisted attack

Summary

A 3AM ransomware affiliate reportedly compromised a UK school estate, reaching nearly 50 machines from an unmanaged host and successfully encrypting approximately 37. BleepingComputer attributes the findings to Bitdefender. The reported activity spanned September 10–19, but investigators could not establish how the attacker initially entered the environment.^[0]

The intrusion combined credential theft, domain discovery, privileged-account persistence, financial-data theft, and expansion across Active Directory boundaries. The attacker targeted credentials on three Veeam backup servers, copied a Chrome credential database, deployed Mimikatz and LSASS memory-dumping tools, and created two backdoor domain-administrator accounts. After stealing financial data, the attacker configured two-way trusts among three previously separate domains before attempting to disable endpoint protection, delete system-state backups, and deploy ransomware.^[0]

AI involvement remains a hypothesis rather than an established finding. Researchers observed repeated commands with small changes at roughly 40–100-second intervals, behavior they considered consistent with an agentic loop. They could not access the attacker's working machine, identify a language model, determine whether it operated locally or remotely, or exclude a person manually transferring instructions and results between a model and the implant. The account therefore supports suspected AI-assisted operation, not confirmed autonomous execution.^[0]

Attack chain

1. Observed operating position; initial access unresolved: The attacker operated from an unmanaged host and reached nearly 50 machines in the school estate. Investigators could not establish the initial-access method, so the evidence does not support a preceding phishing, exploitation, or remote-access phase.^[0]
2. Credential collection: The attacker used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools. The account does not establish the precise order of these credential-access techniques.^[0]
3. Domain and school-estate discovery: The attacker mapped domain relationships and searched logon-script folders for references to other schools, identifying relationships and resources beyond individual compromised machines.^[0]
4. Privileged persistence: The attacker created two backdoor domain-administrator accounts named library and svc_bkpmon.^[0]
5. Financial-data theft: Financial data was stolen from compromised machines. The supplied account does not identify the transfer mechanism, destination, or volume.^[0]
6. Cross-domain expansion: After the financial-data theft, the attacker configured two-way trusts among three previously separate Active Directory domains to expand their reach.^[0]
7. Defense impairment, recovery inhibition, and encryption: In the final stage, the attacker attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM's Rust-based encryptor. Approximately 37 machines were successfully encrypted; the account does not establish that every protection-removal or backup-deletion attempt succeeded.^[0]

Disclosure timeline

Actor profile

3AM

The incident is attributed to a 3AM ransomware affiliate using the operation's Rust-based encryptor. The reported affiliate combined credential theft, privileged-account creation, financial-data theft, cross-domain trust changes, and ransomware deployment. Suspected AI assistance concerns the behavior observed in this intrusion; it does not establish a particular model or a fully autonomous operating method.^[0]

Indicators of Compromise

Key takeaways

• The strongest incident findings concern observable actions and impact: credential theft, privileged persistence, financial-data theft, cross-domain expansion, and approximately 37 encrypted machines.^[0]
• The AI assessment has a clear evidentiary limit. Command timing and iterative changes suggested an agentic loop, but researchers could not inspect the operating machine or distinguish autonomous execution from human-mediated model use.^[0]
• Unauthorized domain trusts and backdoor administrator accounts are central investigation targets in this case, alongside the ransomware payload: the attacker used both to establish or expand privileged access.^[0]

Defensive actions

• Investigate unmanaged hosts with access to the school estate and contain any confirmed attacker operating position.: The reported operation reached nearly 50 machines from an unmanaged host. Reviewing that access path directly addresses the observed operating position without assuming an unsupported initial-entry mechanism.^[0]
• Review the library and svc_bkpmon accounts, their creation history, domain-administrator membership, and authentication activity; disable them where confirmed unauthorized.: Both names were identified as backdoor domain-administrator accounts created during this intrusion. Validation is important because the names are not inherently malicious outside the incident context.^[0]
• Audit two-way trust relationships among the affected Active Directory domains and remove unauthorized changes.: The attacker connected three previously separate domains through two-way trusts to expand access. Those changes are a specific post-compromise control point requiring review.^[0]
• Investigate credential exposure on the three Veeam backup servers and affected endpoints, including PowerShell credential extraction, Chrome credential-database copying, Mimikatz execution, and LSASS dumping; rotate credentials confirmed exposed.: These were the reported credential-access methods. Remediation should account for stolen credentials as well as the separately created backdoor accounts.^[0]
• Review attempts to remove Sophos or Bitdefender protection and delete system-state backups; verify protection and backup availability on reachable hosts.: Protection removal and backup deletion were attempted during the final ransomware stage. The account does not establish their success on every host, making verification necessary.^[0]
• Correlate repeated, slightly modified commands at roughly 40–100-second intervals with credential-access activity, privileged-account creation, and trust changes.: This cadence informed the researchers' AI-assistance hypothesis. It is a useful investigative lead in this incident, but it should not be treated alone as proof of AI use or autonomous execution.^[0]