3AM Ransomware Hits UK Schools Using AI Agents
Original title: Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks
Hackers used AI-style automation with Windows tools to deploy 3AM ransomware on 37 machines in a UK school network.
A ransomware affiliate launched a hybrid attack on a UK school estate using built-in tools and AI agents for repetitive tasks. Attackers stole backup credentials, created fake admin accounts, and deployed the 3AM encryptor after joining domains. Bitdefender identified noisy AI-driven patterns in the operations.
Unconfirmed: Bitdefender could not confirm the exact AI model used
- Affected 37 machines in one school with 47 systems total
- Used modified Veeam script and Mimikatz
- Created domain admin accounts named library and svc_bkpmon
- Retries every 40-101 seconds indicated AI assistance
Impact: ransomware encryption on school network
- 1.protect backup servers
- 2.alert on new domain trusts
- 3.limit WMI access
- Vendors
- Bitdefender
- Products
- Windows
- Threat actors
- 3AM
- Malware
- 3AM
- Victims
- UK schools
- Countries
- United Kingdom
From the original article
4 min read at cybersecuritynews.com
A ransomware affiliate has hit a group of UK schools with a mix of human control and AI-style automation. The attackers used built-in Windows tools, stolen backup passwords and fake admin accounts to spread across the school network, then encrypted about 37 machines. The group behind the encryptor is 3AM, also written ThreeAM.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.