GoKawiilBitdefender ties 3AM ransomware hit on UK schools to possible AI-driven automation
Bitdefender reported that a 3AM ransomware affiliate breached a UK school network between September 10 and 19, reaching nearly 50 machines and encrypting about 37 of them. The attackers stole credentials from Veeam backup servers and a Chrome database, deployed Mimikatz and LSASS-dumping tools, created rogue domain admin accounts, linked three Active Directory domains, and disabled security tools before deploying the encryptor.
GoKawiil's interpretation of the reporting above, not reported fact.
Bitdefender says the pattern of slightly varied commands issued at regular 40-100 second intervals resembles an automated agentic loop, suggesting attackers could be using AI to scale intrusions, though the firm admits it could not confirm whether a language model or a human was behind the commands. If AI-assisted ransomware operations become common, it could lower the technical barrier for attackers and complicate defenders' ability to distinguish human from automated activity.
- About 37 of nearly 50 reachable machines in a UK school network were encrypted by 3AM ransomware.
- Bitdefender suspects AI-generated commands or an agentic automation loop may have driven the attack, based on timing patterns.
- Attackers escalated access via stolen Veeam and Chrome credentials, rogue domain admin accounts, and merged Active Directory domains before deploying the encryptor.
YubiKey 5 Series security key — Ransomware attacks like this one often start with stolen or weak credentials, which is exactly what hardware security keys like the YubiKey are designed to stop. Adding phishing-resistant multi-factor authentication to admin and backup accounts (like the Veeam credentials targeted here) is one of the simplest ways schools and IT teams can harden their estate against these automated, AI-assisted intrusions.
See YubiKey 5 Series security key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-03
Published there as: “UK school estate hit by 3AM ransomware in suspected AI-assisted attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.