UK school estate hit by 3AM ransomware in suspected AI-assisted attack
3AM ransomware affiliate targets UK school estate, encrypting 37 machines in suspected AI-assisted attack.
A 3AM ransomware affiliate has targeted a UK school estate, encrypting approximately 37 out of 50 machines. Researchers suspect the use of AI-generated commands and an automated agentic loop due to repeated, slightly modified commands issued at regular intervals. The attack involved credential extraction, deployment of Mimikatz, and the creation of backdoor accounts, ultimately leading to data theft and encryption.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Bitdefender?
Get an email when a new story names Bitdefender, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA ransomware affiliate leveraged credential theft tools like Mimikatz, created backdoor accounts, and exfiltrated data before encrypting 37 of 50 machines across a UK school estate. Researchers believe AI-assisted automation enabled rapid, iterative command execution, dramatically compressing the attacker's dwell-time-to-damage window. The creation of backdoor accounts indicates that access control hygiene and privileged account monitoring were insufficient to detect and halt lateral movement. This matters because AI-augmented attacks reduce the time defenders have to respond, making proactive hardening and real-time detection no longer optional but essential — especially for under-resourced education sector organisations.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — 3AM ransomware
- malware — Mimikatz
- mitre_attack — T1003