3AM Ransomware Encrypts UK School Systems: AI Clues and Active Directory Defenses

What happened​

A 3AM ransomware affiliate targeted a UK school estate and encrypted around 37 of nearly 50 machines reached from an unmanaged host. The activity ran from September 10 to 19, and Bitdefender could not establish how the attacker first got in.

Bitdefender's own framing is a "hybrid" operation. Some parts show a human operator at the keyboard, while others behave like an AI agent working through the intrusion. Dark Reading's coverage notes that the attack largely followed a familiar ransomware playbook.

The victim environment​

According to Bitdefender's inventory, the estate had 47 systems:

• About 21 servers, including eight domain controllers.
• Ten workstations still on Windows 10, which went out of support in October 2025.
• One domain controller on Windows Server 2012 R2.
• The rest on Windows 11.

The estate was built from several originally separate Active Directory domains. Bitdefender noted two earlier events, a Restricted Admin mode change on four machines in January 2026 and a hand-typed interactive session on June 5. It could not confirm that either was connected to the September intrusion, so neither should be treated as the entry point.

The intrusion, step by step​

September 10–11: backup credentials. The attacker ran a modified version of the public Veeam-Get-Creds PowerShell script against three Veeam backup servers. Bitdefender says the script reads database details from the registry and decrypts stored secrets with Windows DPAPI. A Chrome "Login Data" database was also copied from a terminal server.

September 12–13: reconnaissance. The attacker:

• Tested access to other machines.
• Tried to add a Defender exclusion for C:\Windows\Temp.
• Downloaded Mimikatz.
• Enumerated service accounts and domain trusts.
• Searched SYSVOL logon scripts for references to other schools and network ranges.

September 14: credential theft and persistence. The attacker saved the SECURITY and SYSTEM registry hives from the Server 2012 R2 domain controller and ran Mimikatz disguised as sysmon64.exe. Two backdoor domain admin accounts, "library" and "svc_bkpmon", were created by separate routes. The names were chosen to blend into a school's account list.

September 15: data staging. The attacker collected about 40 files from a finance share. They were staged through registry values, compressed, and sent by HTTP POST to the unmanaged host. Bitdefender doesn't quantify what actually arrived.

September 18: domain trusts. The attacker used netdom to configure two-way trusts between three separate AD domains, along with DNS forwarding and a Netlogon restart. A trust only allows authentication across domains and doesn't grant permissions. The attacker separately pushed backdoor-account access to about 40 machines.

September 19: encryption. Scripts tried to remove Sophos and Bitdefender endpoint protection, but Bitdefender says anti-tampering blocked the removal. A loader went out to about 40 machines, and the ThreeAM encryptor ran from 05:07 to 05:33 UTC. System-state backups were deleted with wbadmin, and about 37 systems were encrypted.

How strong is the AI claim?​

Bitdefender is careful here, and readers should be too. The evidence it cites is:

• Repeated commands with small tweaks between attempts.
• Retry gaps of roughly 40–101 seconds, with longer pauses between tasks.
• A Veeam API call using port 9392 and Basic auth, where vendor documentation shows 9419 and OAuth2.
• A malformed delimiter in a command meant to find the LSASS process.
• Unix-style shell habits inside Windows commands.

On one September 13 sequence, a PowerShell command was rerun unchanged after 41 seconds. It was then tweaked 49 seconds later and swapped for a WMI command 47 seconds after that.

The caveats matter just as much:

• No access to the attacker's machine. As the BleepingComputer report quotes Bitdefender, the researchers believe the actor may have used AI-generated commands and an automated agentic loop. They can't say which model was used, where it ran, or whether a person was copy-pasting between a shell and a model.
• Commodity tooling. The encryptor and most tools were conventional, and the custom payloads Bitdefender could inspect had no natural-language reasoning comments.
• Possibly incomplete logs. The reported intervals may not be a full record.
• Timing isn't proof. Scripted fan-out, such as roughly 101 seconds per machine for deployment, doesn't show AI decision-making.

Dark Reading's description fits the evidence: it wasn't an AI-generated attack, an AI-assisted attack in the strict sense, or an AI-operated one. Bitdefender's forecast is bolder. It says it expects hybrid attacks like this to become more common in 2027. That is a vendor prediction, not a finding from this incident. Bitdefender also sells endpoint security, which is worth remembering when reading threat forecasts.

The national backdrop​

The UK's NCSC published its State of the Cyber Nation report on November 3. It says the country's critical infrastructure should prepare for a ransomware attack involving AI-powered malware by 2028. It also says hostile AI adoption is "highly likely" to raise the scale and efficiency of attacks over the next two years. That is a forward-looking assessment and doesn't confirm that the school case was autonomous.

NCSC chief Richard Horne's framing is the more useful one for admins. Bitdefender's observations suggest the threat actors appear to be experimenting heavily with AI tools. The NCSC says the risk comes from long-tolerated vulnerabilities being found and exploited faster, not from AI inventing new attacks. That matches this case, where a weakness in basic hygiene did most of the damage.

3AM in context​

3AM isn't new. Symantec first saw it when an affiliate switched to it after failing to deploy LockBit. It is a 64-bit executable written in Rust. Sophos has documented affiliates combining email bombing with voice phishing and remote tools such as Teams and Quick Assist. Bitdefender could not establish initial access in this case, so none of that should be assumed here.

Defensive takeaways​

Bitdefender's detection suggestions are specific and practical:

1. Watch backup credential stores. Alert on unusual reads of backup-software credential databases, since the attack began with three Veeam servers.
2. Flag registry hive saves. Alert on reg save of SECURITY, SYSTEM or SAM outside known backup and admin jobs.
3. Monitor new trusts. Alert on new domain trusts and on netdom trust execution.
4. Hunt for odd artifacts. Look for scheduled tasks and files such as VEEAMPROBE, psexec-ok and da_proof.txt, and for registry values used as a file-transfer channel.
5. Inventory unmanaged hosts. Every observed attacker action came from a machine without Bitdefender's agent.
6. Audit domain admins. Review for look-alike accounts such as "library" or "svc_bkpmon".
7. Keep tamper protection on. Anti-tampering stopped the attempted removal of the endpoint agents.

No single control would have prevented this. The common thread is that a school estate with several domains, legacy servers, Windows 10 machines past end of support and an unmonitored host gave the attacker a lot of room. The AI angle may turn out to be real or overstated, but the fix is the same either way. Know what is on your network, watch your backups and trust boundaries, and treat unusual command retries as a signal worth investigating.