A recent attack on a UK school estate saw a **3AM ransomware** affiliate encrypt approximately 37 out of 50 machines, originating from an unmanaged host. The incident has drawn attention due to a compelling theory put forth by **Bitdefender** researchers: the possible use of AI-generated commands and an automated agentic loop by the threat actor. ### The AI Connection **Bitdefender**'s conclusion stems from an observed sequence of repeated commands, each slightly modified and issued at remarkably consistent intervals of 40 to 100 seconds. This pattern suggested an automated, adaptive process, leading to the hypothesis of AI involvement. "We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," **Bitdefender** explained in their report. While direct evidence of the AI model itself remains elusive, the behavioral analysis strongly points towards an agentic loop.  *Attack overview (Source: Bitdefender)* ### Attack Methodology and Expansion The malicious activity unfolded between September 10 and 19, though the initial access method remains undetermined. The threat actor demonstrated sophisticated techniques, including: * Utilizing a modified public **PowerShell** tool to extract and decrypt credentials from three **Veeam** backup servers. * Copying a **Chrome** database containing credentials. * Deploying **Mimikatz** and **LSASS** memory-dumping tools. Further reconnaissance involved mapping domain relationships and searching logon-script folders for links to other schools. This led to the creation of two backdoor domain administrator accounts, named 'library' and 'svc_bkpmon.' After exfiltrating financial data, the attacker escalated their reach by configuring two-way trusts between three previously separate **Active Directory** domains. ### Final Stages and Encryption In the final phase, the attackers attempted to disable existing security measures, specifically targeting **Sophos** and **Bitdefender** protection, and deleting system-state backups. Subsequently, they deployed **3AM**'s Rust-based encryptor, successfully encrypting systems in 37 instances.  *Attack timeline (Source: Bitdefender)* ### The Rise of 3AM Ransomware The **3AM ransomware** first emerged publicly in 2023, notably deployed as a fallback when a **LockBit** attack failed. Researchers have since linked the operation to the notorious **Conti** and **Royal** ransomware gangs. Affiliates have been observed employing tactics such as email bombing and spoofed IT support calls for network infiltration. Past victims include **Kootenai Health**, which suffered an August 2024 attack exposing personal information of over 464,000 patients. ### Preparing for an AI-Powered Future Regardless of the precise extent of AI involvement in this specific attack, **Bitdefender**'s observations indicate a clear trend: threat actors are actively experimenting with AI tools. This aligns with warnings from the UK's **NCSC**, which recently published its 'The State of the Cyber Nation' report, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028. This incident serves as a stark reminder for IT security professionals to bolster their defenses, implement robust monitoring, and stay ahead of rapidly evolving adversary tactics that increasingly leverage advanced technologies.