3AM Ransomware Uses AI to Breach UK Schools
Original title: 3AM Ransomware Hackers Use AI-Assisted Attacks to Breach UK Schools and Spread Across Windows Domains
Bitdefender reports 3AM ransomware compromised 47 systems in UK schools using AI-assisted techniques, establishing domain trusts and exfiltrating data from backup servers.
A ransomware affiliate known as 3AM compromised a UK school network using a mix of intrusion techniques and AI patterns for repetitive tasks. The environment included 47 systems with two-way domain trusts set up after initial access. Credential theft occurred from backup servers via a modified Veeam script, followed by Mimikatz deployment and encryptor execution.
Unconfirmed: Fully automated AI involvement unproven; rhythm interpreted as human-directed with agentic loop support
- Compromised 47 systems including 21 servers and 8 domain controllers
- Established two-way trusts between domains
- Used PowerShell, WMIC and Mimikatz
- Modified Veeam credential-recovery script
- Rust-based encryptor deployed on September 19
Impact: Access to school networks, domain admin accounts and data exfiltration
- 1.Check for unexpected domain trusts
- 2.Review backup credential access
- 3.Monitor for Mimikatz usage
- Vendors
- Bitdefender
- Threat actors
- 3AM Ransomware
- Victims
- UK schools
- Countries
- UK
From the original article
3 min read at gbhackers.com
A ransomware affiliate known as 3AM compromised a UK school network using a mix of traditional intrusion techniques and patterns suggesting the involvement of artificial intelligence. According to Bitdefender’s investigation on November 3, this operation appears to follow a suspected hybrid workflow: a human operator selects the targets while a language model may handle repetitive […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.