UK school estate hit by 3AM ransomware in suspected AI-assisted attack

What it is

Bitdefender incident-response findings on a 3AM ransomware affiliate who hit a UK school estate between 10 and 19 September. The affiliate encrypted about 37 of nearly 50 machines reached from an unmanaged host. Bitdefender could not establish the initial access method.

How it works

The affiliate worked through these steps:

• Used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers.
• Copied a Chrome credential database and ran Mimikatz and LSASS memory-dumping tools.
• Mapped domain relationships and searched logon-script folders for references to other schools.
• Created two backdoor domain administrator accounts, named library and svc_bkpmon.
• Stole financial data from compromised machines.
• Configured two-way trusts between three previously separate Active Directory domains.
• Tried to remove Sophos and Bitdefender protection from reachable hosts, deleted system-state backups, and deployed 3AM's Rust-based encryptor.

Bitdefender suspects AI involvement because the same commands recurred with slight changes at intervals of roughly 40 to 100 seconds, which looks like an agentic loop.

What to do

The page gives no formal mitigation list. Its details point to these checks:

• Search for domain admin accounts named library or svc_bkpmon.
• Review recently created two-way trusts between AD domains that were previously separate.
• Treat Veeam server credentials and browser-stored credentials as exposed if an intruder reaches those hosts.
• Alert on endpoint protection being removed and system-state backups being deleted, which came just before encryption.
• Inventory unmanaged hosts that can reach managed machines, since the attack was launched from one.

Caveats

Bitdefender could not access the attacker's machine. It cannot say which model was used, whether it ran locally or remotely, or whether a person was pasting instructions and results between the implant and a model. It documented only behavior that resembles an agentic loop. Initial access remains unknown, so the page offers nothing on closing the entry point.

For context, the page notes that 3AM emerged in 2023 and has links to the Conti and Royal gangs. Its affiliates have been seen using email bombing and spoofed IT support calls. A past victim is Kootenai Health, where an August 2024 attack exposed data on more than 464,000 patients.