UK School Hit by 3AM Ransomware in Suspected AI Attack
Original title: UK school estate hit by 3AM ransomware in suspected AI-assisted attack
3AM ransomware encrypted 37 machines in a UK school estate using suspected AI-generated commands.
Bitdefender researchers observed a 3AM ransomware attack on a UK school estate. The threat actor encrypted around 37 of nearly 50 machines reached from an unmanaged host. Initial access was not established. Attackers used a modified PowerShell tool to extract credentials from Veeam backups, deployed Mimikatz and LSASS dumping tools, and created two backdoor administrator accounts. They mapped domains, added two-way trusts, removed security products, and deployed the Rust-based encryptor. Bitdefender noted repeated commands issued at regular intervals, suggesting an agentic loop possibly using AI-generated instructions.
Unconfirmed: Bitdefender could not access the attacker's machine to document the AI model used or confirm whether a person was involved in command generation.
- 37 machines successfully encrypted.
- Used credential extraction from Veeam servers.
- Created domain administrator backdoors named library and svc_bkpmon.
- NCSC urges preparation for AI-powered ransomware by 2028.
Impact: encryption of school estate machines
| Product | Affected |
|---|---|
| UK school estate | — |
- Threat actors
- 3AM ransomware
- Malware
- 3AM
- Victims
- UK school estate
- Organizations
- Bitdefender
- Countries
- UK
From the original article
2 min read at bleepingcomputer.com
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.