Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks
3AM ransomware affiliate uses AI agents for automated tasks in UK school network attacks.
A ransomware affiliate, using the 3AM encryptor, has targeted UK schools with a hybrid approach combining human oversight and AI-style automation for repetitive tasks. Attackers exploited stolen backup passwords and created fake admin accounts to spread across the network, encrypting approximately 37 machines. Bitdefender researchers observed patterns suggesting an AI model handled tasks like retrying failed commands, fitting a hybrid model where a person directs the overall operation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Veeam?
Get an email when a new story names Veeam, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers gained a critical foothold by exploiting stolen backup passwords — a severe access control failure that handed them administrative-level trust within the network. By creating fake admin accounts, they moved laterally and encrypted 37 machines before defences could respond. The use of AI-style automation to retry failed commands demonstrates that attackers are lowering the skill floor for sustained, persistent intrusions. Schools, often under-resourced for cybersecurity, must treat backup credential protection and privileged account governance as non-negotiable priorities, not optional hardening steps.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — 3AM
- malware — ThreeAM
- mitre_attack — T1003
- mitre_attack — T1547.001
- mitre_attack — T1071.001