[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f11fsiMaU1vd7sJJxLjCUmdWI8luV_XfeGNjkVX_-LDU":3},{"article":4,"iocs":55,"watch_terms":72,"solutions":73,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":37},"37e6d1fe-c4a3-4f12-9d18-628109740d8b","Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks","hackers-use-ai-agents-to-launch-3am-ransomware-attacks-against-uk-school-network-525f36","A ransomware affiliate has hit a group of UK schools with a mix of human control and AI-style automation. The attackers used built-in Windows tools, stolen backup passwords and fake admin accounts to spread across the school network, then encrypted about 37 machines. The group behind the encryptor is 3AM, also written ThreeAM. It sells […] The post Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks appeared first on Cyber Security News.","A ransomware affiliate, using the 3AM encryptor, has targeted UK schools with a hybrid approach combining human oversight and AI-style automation for repetitive tasks. Attackers exploited stolen backup passwords and created fake admin accounts to spread across the network, encrypting approximately 37 machines. Bitdefender researchers observed patterns suggesting an AI model handled tasks like retrying failed commands, fitting a hybrid model where a person directs the overall operation.","3AM ransomware affiliate uses AI agents for automated tasks in UK school network attacks.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-ai-agents-2\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-AI-Agents-to-Launch-3AM-Ransomware-Attacks-Against-UK-School-Networks.webp","2026-11-03T15:55:08+00:00","2026-11-03T16:00:40.045845+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"3AM","threat_actor",{"name":21,"type":22},"Veeam","vendor",{"name":24,"type":25},"Mimikatz","product",{"name":27,"type":28},"AI Agents","technology",{"name":30,"type":28},"Ransomware",{"name":32,"type":22},"Bitdefender","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":33,"icon":35,"name":30,"slug":36},null,"ransomware",[38,43,45,50],{"category":39},{"id":40,"icon":35,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":33,"icon":35,"name":30,"slug":36},{"category":46},{"id":47,"icon":35,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":51},{"id":52,"icon":35,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59,62,66,69],{"type":57,"value":18,"context":58},"malware","Ransomware encryptor used in the attack",{"type":57,"value":60,"context":61},"ThreeAM","Alternative name for the 3AM ransomware",{"type":63,"value":64,"context":65},"mitre_attack","T1003","Mimikatz used for credential dumping",{"type":63,"value":67,"context":68},"T1547.001","Creation of fake admin accounts for persistence",{"type":63,"value":70,"context":71},"T1071.001","Use of Windows registry for data exfiltration",[21,32,24],{"controls":74,"vendors":160},[75,104,132],{"slug":76,"name":77,"problem":78,"products":79},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":105,"name":106,"problem":107,"products":108},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":126,"vendor_name":32,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":133,"name":134,"problem":135,"products":136},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[137,144,152],{"vendor_slug":138,"vendor_name":21,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[161,164],{"slug":126,"name":32,"logo_path":127,"roles":162},[163],"reported_by",{"slug":138,"name":21,"logo_path":139,"roles":165},[166],"affected",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":179},"ai-assisted-3am-ransomware-exploits-stolen-backup-credentials-in-uk-schools","AI-Assisted 3AM Ransomware Exploits Stolen Backup Credentials in UK Schools","Attackers gained a critical foothold by exploiting stolen backup passwords — a severe access control failure that handed them administrative-level trust within the network. By creating fake admin accounts, they moved laterally and encrypted 37 machines before defences could respond. The use of AI-style automation to retry failed commands demonstrates that attackers are lowering the skill floor for sustained, persistent intrusions. Schools, often under-resourced for cybersecurity, must treat backup credential protection and privileged account governance as non-negotiable priorities, not optional hardening steps.",[172,173,174,175,176,177,178],"CIS Control 5: Account Management","CIS Control 11: Data Recovery","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing",{"MITRE ATT&CK T1566: Phishing":180,"CIS Control 11: Data Recovery":181,"CIS Control 5: Account Management":182,"NIST SP 800-53 SI-2: Flaw Remediation":183,"CIS Control 17: Incident Response Management":184,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":185,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":186},"Stolen backup passwords likely originated from phishing or credential harvesting; understanding this initial access technique informs defences such as phishing-resistant MFA and security awareness training for school staff.","Backup passwords were the attackers' entry point; CIS Control 11 requires protecting backup systems with separate credentials and ensuring backups are stored in a manner that ransomware cannot reach or encrypt them.","Attackers created fake admin accounts and abused stolen privileged credentials; strict account inventory, MFA on all admin accounts, and disabling unused accounts would have blocked or limited this lateral movement.","While primarily credential-based, the attackers' ability to persist undetected indicates gaps in monitoring and hardening; SI-2 supports timely remediation of weaknesses including configuration and access policy flaws.","A tested incident response plan with pre-defined steps for credential compromise and network isolation would have reduced dwell time and the number of machines encrypted.","Protecting backup infrastructure and privileged accounts falls under technical vulnerability management; this control would require schools to assess and harden backup systems against credential theft scenarios.","The compromise of backup credentials and creation of rogue admin accounts reflects a failure in identity governance; PR.AA calls for least-privilege access and continuous validation of account legitimacy."]