3AM Ransomware Hits UK School With Suspected AI Commands

3AM ransomware encrypted 37 machines in a UK school estate using suspected AI-generated commands.

Bitdefender researchers observed a 3AM ransomware attack on a UK school estate. Attackers encrypted 37 machines reached from an unmanaged host without establishing initial access. They used a modified PowerShell tool to extract credentials from Veeam backups, deployed Mimikatz and LSASS dumping tools, created two backdoor administrator accounts named library and svc_bkpmon, mapped domains, added two-way trusts, removed security products, and deployed the Rust-based encryptor. Repeated commands issued at regular intervals suggest an agentic loop possibly using AI-generated instructions. A hybrid AI approach for command generation and human oversight in high-level decisions was noted.