Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks

A ransomware affiliate has hit a group of UK schools with a mix of human control and AI-style automation. The attackers used built-in Windows tools, stolen backup passwords and fake admin accounts to spread across the school network, then encrypted about 37 machines.

The group behind the encryptor is 3AM, also written ThreeAM. It sells its Rust-based ransomware to affiliates, who do the break-ins and share the profit.

Readers who followed earlier ThreeAM ransomware reports will know the group usually targets small and mid-sized victims.

Researchers at Bitdefender noted the malware and the unusual behavior behind it. They call it a hybrid operation: a person picks the goals, while a language model appears to handle repetitive work such as retrying failed commands.

They also say they could not prove which model was used, or whether a person was pasting results back and forth.

Hackers Use AI Agents

The victim was a UK school estate with 47 systems. These included about 21 servers, eight of them domain controllers, and ten workstations still running Windows 10.

The network began as several separate Active Directory domains that did not connect to each other. Bitdefender could not tell how the attackers got in.

Their first recorded move, on 10 and 11 September, was to steal passwords from three backup servers using a modified public Veeam script. Defenders who track Veeam backup security fixes will see why backup software is such a popular target.

The attackers then ran Mimikatz, renamed sysmon64.exe, and created two domain admin accounts named “library” and “svc_bkpmon”. The names were chosen to blend into a school’s account list.

On 15 September they moved 40 finance files through the Windows registry and sent them to a server they controlled. The clearest sign of AI use came on 13 September.

The attacker ran a command, ran it again unchanged 41 seconds later, changed one call 49 seconds after that, and then switched to a different tool 47 seconds later.

Retries across the attack came every 40 to 101 seconds, while moving to a new task took minutes. That pattern fits a person choosing the goals and a model handling the retries.

The commands also contained mistakes a model would make when writing from memory. One call to Veeam used the wrong port and login method.

Bash-style escape characters appeared inside Windows commands on three different days. The attackers also left behind test files with names like “psexec-ok” and “da_proof.txt”, plus numbered script versions such as av_remove, av_remove2 and av_remove3.

On 18 September, the attackers joined three domains with two-way trusts, using the built-in netdom and dnscmd tools.

They also searched shared folders for the names and networks of other schools. This kind of fiddly setup work, where an error message points to the fix, suits a model well.

On 19 September, the attackers tried to remove security software from the file server, but anti-tampering controls blocked it. They then ran the ThreeAM encryptor, host.exe, between 05:07 and 05:33 UTC at 12 to 13 seconds per machine. It deleted system-state backups as it went.

What Defenders Should Take From This Case

Bitdefender is careful to say this is one case and not a trend. The toolkit was old, the encryptor was a standard build, and no step needed new skills. The company expects hybrid attacks like this to become more common in 2027.

The same research stresses that AI-run intrusions are noisy. A loop that retries every minute leaves repeated commands, probe files and numbered scripts behind.

This matches other cases the site has covered, such as AI agents running ransomware in the JadePuffer campaign, where a model planned and carried out an extortion operation.

The attack also fits a wider pattern of Cursor-driven Aur0ra ransomware cases, where AI coding agents handled most of the network work.

Bitdefender advises to keep admin accounts for separate domains apart, alert on any new domain trust or on netdom use, protect backup servers and keep copies that no domain account can delete, limit WMI, remote registry and ADMIN$ access to known management hosts, put an endpoint agent on every machine.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks appeared first on Cyber Security News.