[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkGDo0NNjU73NsqUiFMqj9dPJwhkuFvPLuRnYjPlKIMs":3},{"article":4,"iocs":51,"watch_terms":87,"solutions":88,"lesson":176},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"326dc3e2-d110-4090-b471-02556081df04","3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack","3am-ransomware-hits-37-uk-school-systems-in-suspected-ai-assisted-attack-43b47e","Bitdefender details a 3AM ransomware attack on a UK school estate that encrypted 37 systems, with command timing suggesting possible AI-assisted troubleshooting.","Bitdefender has investigated a 3AM ransomware attack on a UK school estate, encrypting 37 systems. The attack exhibited characteristics of AI assistance, with command retries suggesting an AI-driven loop for troubleshooting, though a human operator was still involved. The group utilized living-off-the-land techniques and common tools to achieve their objectives.","3AM ransomware group targets UK schools, potentially using AI for command retries.","https:\u002F\u002Fhackread.com\u002F3am-ransomware-uk-school-systems-ai-attack\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F3am-ransomware-hits-37-uk-school-in-suspected-ai-assisted-attack.jpg","2026-11-03T16:10:42+00:00","2026-11-03T17:00:30.23599+00:00",8,[17,20,23,26],{"name":18,"type":19},"3AM ransomware group","threat_actor",{"name":21,"type":22},"Bitdefender","vendor",{"name":24,"type":25},"AI","technology",{"name":27,"type":25},"Active Directory","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":28,"icon":30,"name":31,"slug":32},null,"Ransomware","ransomware",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,60,63,66,69,72,75,78,81,84],{"type":53,"value":54,"context":55},"malware","3AM ransomware","Ransomware used in the attack",{"type":57,"value":58,"context":59},"mitre_attack","T1059.001","Use of PowerShell for command execution",{"type":57,"value":61,"context":62},"T1047","Use of WMI for command execution",{"type":57,"value":64,"context":65},"T1059.003","Use of cmd.exe for command execution",{"type":57,"value":67,"context":68},"T1548.002","Bypass User Account Control",{"type":57,"value":70,"context":71},"T1003.001","OS Credential Dumping: LSASS Memory",{"type":57,"value":73,"context":74},"T1552.001","Credentials In Files: Credentials In Registry",{"type":57,"value":76,"context":77},"T1071.004","Application Layer Protocol: DNS",{"type":57,"value":79,"context":80},"T1110.003","Brute Force: Password Spraying",{"type":57,"value":82,"context":83},"T1098.002","Account Manipulation: Additional Local Groups",{"type":57,"value":85,"context":86},"T1070.004","Indicator Removal: File Deletion",[21],{"controls":89,"vendors":172},[90,118,143],{"slug":91,"name":92,"problem":93,"products":94},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[95,103,110],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":91,"product_name":107,"url":108,"description":109},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":119,"name":120,"problem":121,"products":122},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[123,128,136],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":124,"product_name":125,"url":126,"description":127},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":137,"vendor_name":21,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":144,"name":145,"problem":146,"products":147},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[148,156,164],{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":165,"vendor_name":166,"vendor_logo":167,"product_slug":168,"product_name":169,"url":170,"description":171},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[173],{"slug":137,"name":21,"logo_path":138,"roles":174},[175],"reported_by",{"slug":177,"title":178,"body":179,"framework_refs":180,"framework_notes":188},"3am-ransomware-encrypts-37-uk-school-systems-using-ai-assisted-tactics","3AM Ransomware Encrypts 37 UK School Systems Using AI-Assisted Tactics","The 3AM ransomware group successfully encrypted 37 systems across a UK school estate by leveraging living-off-the-land (LOTL) techniques that blend into normal administrative activity, making detection significantly harder. A notable evolution in this attack was the suspected use of AI to automate command retries and troubleshoot obstacles during execution, lowering the skill barrier for attackers and increasing operational efficiency. Schools and educational institutions are particularly vulnerable because they often lack dedicated security teams and operate with under-resourced IT environments. This incident underscores that attackers are actively incorporating AI tooling to accelerate and refine ransomware campaigns, demanding that defenders raise their detection and response capabilities to match.",[181,182,183,184,185,186,187],"CIS Control 13: Network Monitoring and Defense","CIS Control 11: Data Recovery","CIS Control 17: Incident Response Management","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":189,"MITRE ATT&CK T1566: Phishing":190,"CIS Control 11: Data Recovery":191,"CIS Control 17: Incident Response Management":192,"CIS Control 13: Network Monitoring and Defense":193,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":194,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":195},"NIS2 mandates that operators of essential services implement incident handling measures and business continuity controls, directly requiring the kind of segmentation and backup disciplines that would have limited ransomware spread across the school estate.","Living-off-the-land attacks typically require an initial foothold; understanding and defending against common initial access vectors like phishing is critical to preventing the ransomware from ever executing.","Maintained, tested, and offline backups across all school systems would have allowed rapid restoration without ransom payment after the ransomware encrypted the estate.","A pre-defined ransomware incident response playbook would have enabled the school estate to contain and eradicate the threat faster, limiting the number of systems encrypted to far fewer than 37.","Continuous monitoring of network traffic for anomalous lateral movement and repeated command execution — hallmarks of this AI-assisted attack — would have triggered alerts before 37 systems were encrypted.","A formal vulnerability management process ensuring timely patching and configuration hardening across all 37 school systems would have reduced the attack surface available for the 3AM group to exploit.","Restricting which accounts and devices can execute administrative tools (abused via LOTL techniques in this attack) would have reduced the attacker's ability to move laterally and deploy ransomware at scale."]