Cybersecurity
UK school estate hit by 3AM ransomware
Bitdefender said a 3AM affiliate attacked a UK school estate in September, used stolen credentials and domain trusts to spread, and encrypted about 37 machines while researchers examined possible AI-assisted command patterns.
- Bitdefender said a 3AM ransomware affiliate targeted a UK school estate and encrypted about 37 of nearly 50 machines reached from an unmanaged host.
- The company said the malicious activity took place between 10 and 19 September, and it could not establish how the attacker first got in.
- Bitdefender said the attacker used a modified public PowerShell tool, copied a Chrome credential database, and deployed Mimikatz and LSASS memory-dumping tools.
- It said the attacker created backdoor domain administrator accounts named library and svc_bkpmon, then set up two-way trusts between three Active Directory domains.
- Researchers said the pattern of repeated commands, altered slightly each time and sent at roughly 40 to 100 second intervals, suggested possible AI-generated instructions or an agentic loop.
Bitdefender said the incident ran from 10 to 19 September and began from an unmanaged host. The company said the attacker reached nearly 50 machines and encrypted about 37 of them.
Bitdefender said the intruder used a modified public PowerShell tool to extract and decrypt credentials from three Veeam backup servers. It also said the attacker copied a Chrome credential database and used Mimikatz and memory-dumping tools aimed at LSASS.
The attacker then mapped domain relationships, searched logon-script folders for references to other schools, and created two backdoor administrator accounts called library and svc_bkpmon. Bitdefender said financial data was taken from compromised machines and two-way trusts were created between three separate Active Directory domains.
The company said the attacker later tried to remove Sophos and Bitdefender protection, delete system-state backups, and deploy 3AM’s Rust encryptor. Its researchers said the repeated command pattern looked like an agentic loop, but they could not inspect the machine used by the attacker.
Named in this story
Companies
- Bitdefender
- Its researchers assessed the attack and reported the indicators
- Veeam
- Its backup servers were used to extract and decrypt credentials
- Sophos
- The attacker tried to remove its protection from reachable hosts
Products and systems
- 3AM
- Its ransomware affiliate encrypted machines in the incident
- Chrome
- Its credential database was copied by the attacker
- Mimikatz
- The attacker deployed it for credential theft
- Active Directory
- Three domains were linked with two-way trusts during the attack
Places
- UK
- The school estate attacked was in this location
How the source tells it
The piece was restrained and technical, with a cautious speculative thread around possible AI assistance.
- speculation the researchers said they could not inspect the attacker’s machine and could only infer AI use from the timing and repetition of commands