3AM ransomware uses human-AI hybrid tactics in UK school compromise
Original title: 3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compromise
The group encrypted 37 machines and built domain trusts across the estate using a split human-AI approach.
Bitdefender investigated a 3AM ransomware attack on a UK school estate that ran from September 10 to 19 2026. Attackers stole backup credentials, used WMI and PowerShell for lateral movement, dumped credentials with Mimikatz, exfiltrated files, and built domain trusts to reach 50 machines. They then encrypted 37 of them. The operation mixed human decision-making with AI for repetitive tasks.
- 37 machines encrypted
- Hybrid human-AI tactics used
- Domain trusts created between schools
- Backdoor accounts created
- First documented hybrid attack in Europe
Impact: data encryption and exfiltration
- 1.Keep administrative accounts in separate domains separate
- 2.Treat backup infrastructure as a target
- 3.Restrict remote execution and administrative shares
- Vendors
- Bitdefender
- Threat actors
- 3AM
- Malware
- 3AM ransomware
- Victims
- UK schools
- Countries
- UK
From the original article
4 min read at infosecurity-magazine.com
Bitdefender highlighted a unique human-AI approach during a September attack on a UK school estate, which resulted in financial data being exfiltrated
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.