3am Ransomware - GoKawiil

Bitdefender finds AI-assisted 3AM ransomware attack on UK school network

Bitdefender published research describing a 3AM ransomware affiliate attack on a UK school estate in which attackers stole backup credentials, created rogue domain-admin accounts, linked separate Active Directory domains, and spread across schools before deploying ransomware. Bitdefender says an AI system appeared to generate repetitive commands and troubleshoot issues while a human operator retained control of high-level decisions, using standard Windows tools like PowerShell and WMI throughout.

darkreading.com · 2026-11-03

Bitdefender ties 3AM ransomware hit on UK schools to possible AI-driven automation

Bitdefender reported that a 3AM ransomware affiliate breached a UK school network between September 10 and 19, reaching nearly 50 machines and encrypting about 37 of them. The attackers stole credentials from Veeam backup servers and a Chrome database, deployed Mimikatz and LSASS-dumping tools, created rogue domain admin accounts, linked three Active Directory domains, and disabled security tools before deploying the encryptor.

bleepingcomputer.com · 2026-11-03