A 3AM ransomware affiliate encrypted roughly 37 of nearly 50 machines it reached at a UK school estate, in an intrusion that Bitdefender researchers believe may have been carried out with AI-generated commands and an automated agentic loop. The activity ran from September 10 to 19, but Bitdefender could not establish the attacker’s initial access method.
Bitdefender's conclusion rests on the pattern of the attacker's commands rather than on any direct evidence of a model: the same commands came back repeatedly, slightly modified at each attempt, and were issued at roughly regular intervals of 40 to 100 seconds. The company said the behaviour looked similar to an agentic loop.
The researchers were explicit about the limits of what they could show. "We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," Bitdefender said.
3AM emerged in 2023 and drew public attention when an attacker deployed its Rust-based ransomware after LockBit was blocked. Researchers later linked the operation to the Conti and Royal ransomware gangs, and affiliates have been observed using email bombing and spoofed IT support calls to gain access to corporate networks. A notable earlier victim was Kootenai Health, where an attack in August 2024 exposed personal information belonging to more than 464,000 patients.
According to Bitdefender's account, the attacker used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database holding credentials, and deployed Mimikatz and LSASS memory-dumping tools. The attacker mapped domain relationships and searched logon-script folders for references to other schools, then created two backdoor domain administrator accounts named 'library' and 'svc_bkpmon'. After stealing financial data from compromised machines, the attacker set up two-way trusts between three previously separate Active Directory domains to widen its reach.
In the final stage, the attacker tried to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups and deploy 3AM's Rust-based encryptor, which succeeded in about 37 cases.
The UK's National Cyber Security Centre published this year's 'The State of the Cyber Nation' report on the same day, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028. Bitdefender said its observations suggest threat actors are experimenting heavily with such tools, regardless of the current level of AI tool involvement in 3AM attacks.
Analysis
Why This Matters
- The intrusion moved from a single unmanaged host to backup servers, credential stores and three separate Active Directory domains, and the attackers searched for references to other schools, so the exposure extended well beyond the machines that were encrypted.
- Bitdefender's AI claim is behavioural inference, not proof: the evidence is a command cadence, and the researchers say they could not identify the model, where it ran, or whether a human relayed instructions. Readers should treat the AI element as a hypothesis under examination.
- The NCSC's 2028 warning gives critical infrastructure operators a stated deadline for preparing for AI-driven ransomware.
Background
Ransomware attacks on schools and hospitals have become a recurring problem because these organisations hold large volumes of sensitive personal data and often run older, interconnected IT systems with limited security staffing. Ransomware operators frequently work through affiliates, who carry out break-ins and share the proceeds, which spreads techniques quickly across unrelated crews. Security researchers have been watching for signs that attackers are automating reconnaissance and lateral movement with AI tools, since automation could shorten the time between initial access and encryption and make attacks more consistent.
Key Perspectives
Bitdefender researchers: believe the repeated, slightly modified commands issued at 40 to 100 second intervals resembled an agentic loop, while stating they could not document the language model, whether it ran locally or remotely, or whether a person was copying instructions between the implant and the model.
UK National Cyber Security Centre: in its 'The State of the Cyber Nation' report, urges critical infrastructure to prepare for AI-powered ransomware attacks by 2028.
What to Watch
- Whether the initial access route into the school estate is ever established; Bitdefender said it could not determine it.
- Whether other incident responders report a similar command cadence in unrelated intrusions, which would strengthen the case that AI tooling is being used routinely.
- The NCSC's 2028 target as a benchmark for what critical infrastructure operators are expected to have in place.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedAround 37 of nearly 50 machines reached at the UK school estate were encrypted.BleepingComputer: “successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.”
- SupportedResearchers believe AI-generated commands and an automated agentic loop may have been used in the intrusion.BleepingComputer: “Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.”
- SupportedBitdefender could not document which language model was involved, or whether a person was copying and pasting between the implant and the model.BleepingComputer: “we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model”
- SupportedThe activity ran from September 10 to 19.BleepingComputer: “The malicious activity spanned between September 10 and19”
- SupportedBitdefender could not establish the attacker’s initial access method.BleepingComputer: “Bitdefender could not establish the attacker’s initial access method.”
- SupportedThe attacker’s commands repeated with slight modifications at intervals of roughly 40 to 100 seconds.BleepingComputer: “a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds.”
- SupportedThe direct quote about not accessing the attacker’s machine and being unable to document the model is accurately reproduced and attributed to Bitdefender.BleepingComputer: “We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely”
- SupportedThe attacker used a modified public PowerShell tool to extract and decrypt credentials from three Veeam backup servers.BleepingComputer: “The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers”
- SupportedThe attacker created two backdoor domain administrator accounts named ‘library’ and ‘svc_bkpmon’.BleepingComputer: “eventually creating two backdoor domain administrator accounts named ‘library’ and ‘svc_bkpmon.’”
- SupportedThe attacker configured two-way trusts between three previously separate Active Directory domains after stealing financial data.BleepingComputer: “After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach.”
- SupportedThe attacker attempted to remove Sophos and Bitdefender protection, delete system-state backups and deploy 3AM’s encryptor; it succeeded in about 37 cases.BleepingComputer: “In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor. They succeeded in about 37 cases.”
- SupportedThe UK NCSC published this year’s ‘The State of the Cyber Nation’ report on the same day, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.BleepingComputer: “Earlier today, the NCSC in the UK published this year’s ‘The State of the Cyber Nation’ report, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.”
