Bitdefender links 3AM attack on UK school to AI-like loops

Bitdefender says a 3AM ransomware affiliate attacked a school in the UK, stealing backup credentials, creating rogue domain-admin accounts and linking previously separate Active Directory domains. The attackers used those connections to move between schools, steal data and deploy 3AM ransomware.

They also relied on standard Windows tools, including PowerShell, Windows Management Instrumentation, reg, netsh and rundll32, alongside Mimikatz, an Impacket-style remote-execution tool and a previously published Veeam script.

The security vendor believes an AI system may have generated commands and handled repeated troubleshooting while a human operator chose the overall course of the attack. It pointed to scripts with numbered revisions and confirmation files, repeated attempts, and a Veeam web-interface call using a port and login method that did not match the vendor’s documentation.

Researchers also found that retries came faster than a person would typically issue commands by hand, but more slowly than a fully automated system might act. Bitdefender could not access the attacker’s machine or produce direct evidence of an AI model, and stopped short of claiming the operation was fully automated.

Bitdefender said the attackers used a domain controller to find trust relationships and search SYSVOL for other schools’ names and subnets. The vendor recommends separating administrative credentials across domains, protecting backups, restricting remote execution and administrative shares to known management hosts, blocking interpreters on machines that do not need them, and deploying endpoint security across all machines. It said repeated commands, small changes, numbered scripts and probe files may be signs of an agentic loop.