3AM Ransomware Hits UK School Network in Suspected AI

A cyberattack targeting a school organization in the United Kingdom occurred between September 10 and September 19, 2026, involving attackers linked to the 3AM ransomware group. The intrusion involved accessing nearly 50 computers through an unmanaged host, resulting in the encryption of approximately 37 systems. Analysis revealed attackers utilized a modified PowerShell tool to extract credentials from Veeam Backup servers and used Mimikatz and LSASS dumping to collect authentication data from Chrome databases. The threat actors conducted reconnaissance on domain relationships and stole financial information before establishing two-way trust relationships across three previously separated Active Directory domains. In the final stage, the attackers attempted to remove security software and backups before deploying 3AM ransomware, which encrypts files using a Rust-based mechanism. Researchers noted the potential use of Artificial Intelligence in generating commands for the operation, although Bitdefender could not confirm this involvement. The attack pattern suggests threat actors may be experimenting with AI to support advanced stages of cyber operations, aligning with warnings from bodies like the NCSC regarding future ransomware threats.

The sequence of actions reveals a progression from initial credential harvesting and internal reconnaissance to establishing complex, cross-domain persistence before executing destructive payload deployment. The involvement of publicly available code for tool modification, combined with memory scraping techniques like Mimikatz and the deliberate creation of backdoor accounts (library and svcbkpmon), illustrates a standard adversary playbook focused on escalating privilege and lateral movement within an enterprise environment. The subtle inclusion of AI in command generation suggests a potential evolution in threat actor sophistication, moving from scripted attacks to more adaptive, iterative operational loops. This transition echoes the broader context noted by the NCSC warning about future AI-enabled ransomware threats, implying that the integration of generative techniques is no longer theoretical but an operational consideration for threat actors. The implication for organizational defense lies not just in blocking known malware, but in scrutinizing the entire lifecycle of access—from unmanaged hosts and credential storage (Veeam backups) to Active Directory trust configurations. The focus shifts from perimeter defense to the integrity of internal identity structures. What assumptions about AI integration are currently being made by defenders regarding adversarial capability? How does acknowledging potential AI-assisted operations change the prioritization for threat hunting activities focused on command sequences versus static artifact analysis?