Breaches

3AM ransomware hits UK school estate in suspected AI-assisted attack

A 3AM affiliate stole Veeam credentials and built domain trusts to encrypt 37 machines at a UK school estate. Bitdefender suspects AI helped.

Illustration of a server rack representing a ransomware attack on a UK school estate

A 3AM ransomware affiliate stole backup credentials, bridged separate Active Directory domains and encrypted about 37 machines at an unnamed UK school estate. Bitdefender believes a language model handled much of the repetitive keyboard work, but says the evidence is circumstantial and the weaknesses exploited were entirely familiar.

What happened

On 3 November 2026 Bitdefender published its investigation into a ransomware intrusion that ran from 10 to 19 September against a school estate. The research is headlined as an attack on “European schools”, but the body of the write-up places the victim in the UK, and CyPro, Hackread and other outlets have reported it as a UK school estate. The organisation has not been named, and CyPro said that, as of 3 November, no leak-site listing linked to the attack had surfaced.

Bitdefender attributes the attack, with confidence, to an affiliate of 3AM (also written ThreeAM), a ransomware-as-a-service operation whose Rust-based encryptor is leased to criminals who carry out the break-ins and split the proceeds. The estate held 47 systems, including around 21 servers, eight of them domain controllers, ten Windows 10 workstations that have been out of support since October 2025 and one Windows Server 2012 R2 domain controller. About 37 machines were encrypted on the morning of 19 September, between 05:07 and 05:33 UTC.

Before encryption, about 40 finance-share files were sent to a machine the attacker controlled. Bitdefender could not establish how the attacker first got in.

The technical picture

The playbook was conventional. The first September activity Bitdefender recorded, across 10 and 11 September, went after backups: a modified copy of a public Veeam credential script read and decrypted the passwords stored on three Veeam backup servers. No new Veeam vulnerability was involved; the attacker abused the way the product stores credentials for its own jobs.

From there the affiliate moved through reconnaissance and credential dumping, using Mimikatz renamed to look like a Sysmon binary, copying credential-bearing registry hives off the ageing 2012 R2 domain controller and attempting to dump LSASS memory. Two backdoor domain administrator accounts were created, named “library” and “svc_bkpmon”, names that would look unremarkable among the accounts of an education network.

The most consequential step came on 18 September. The estate had started life as several unconnected domains, and in a window of about three hours the attacker built two-way trusts between three of them with standard Windows utilities (netdom and dnscmd), then pushed the backdoor account’s rights to around 40 machines by scheduled task. On 19 September attempts to strip out Sophos and Bitdefender endpoint agents were blocked by tamper protection, so the affiliate simply ran the encryptor, which deleted Windows system-state backups as it went.

The AI question needs care. Bitdefender describes it as a hybrid: a human apparently choosing objectives, with something resembling an agentic loop, software that hands each result back to a model, handling retries. Its evidence is behavioural. Retries arrived every 40 to 101 seconds regardless of how much the command changed, while moves to a new task took several minutes. Commands also carried errors typical of writing from memory, such as a Veeam API call on the wrong port with the wrong authentication, plus Unix shell habits inside Windows commands.

Bitdefender is explicit about the limits. It never saw the machine the attacker worked from, an unmanaged host with no agent installed, so it cannot say which model was used, where it ran, or whether a person was simply pasting output into a chatbot. The firm calls the case “one case, an anecdote, and not a trend”, and says it found nothing novel in the tooling.

Timeline of the 3AM ransomware intrusion at a UK school estate, from Veeam credential theft on 10 September to encryption on 19 September

Why it matters for UK organisations

Schools and multi-academy trusts are a natural fit for this attack. Many estates grow through mergers, leaving several domains, shared backup infrastructure and IT run by small teams or outsourced providers. The attacker’s reconnaissance combed logon scripts for other schools’ names and network ranges, which suggests deliberate interest in spreading across a group rather than a single site.

The timing also lands neatly alongside the NCSC’s State of the Cyber Nation report, published the same day, which expects AI-enabled malware to be used against UK critical national infrastructure in a ransomware incident by 2028. NCSC chief executive Richard Horne framed the coming risk as old weaknesses being exploited faster, saying it “is not because AI has invented new ways to attack us”. This case fits that description closely.

There is a data protection dimension too. Finance records left the network, and under UK GDPR a notifiable personal data breach must be reported to the UK data protection regulator within 72 hours of the organisation becoming aware of it.

Expert view

Strip out the AI angle and this is a very familiar intrusion. Backup servers holding privileged credentials, out-of-support Windows, a machine on the network without an endpoint agent, and nobody alerted when a new domain trust appeared. In my experience, backup infrastructure is one of the most reliable routes to domain admin on an internal test, because it needs wide rights to do its job and is rarely hardened like a domain controller.

What a model appears to have contributed here is patience with fiddly tasks. Building trusts between domains is order-sensitive work where one wrong detail stops everything, and an assistant that reads the error and tries again lowers the skill bar for an affiliate. That does not make the attack faster or quieter. If anything, Bitdefender’s point that agentic loops are noisy is the most useful takeaway: repeated identical commands, probe files and numbered scripts are easy to spot if anyone is watching.

I would caution against headlines that call this an autonomous AI attack. The vendor does not make that claim, and chasing a sci-fi threat model risks neglecting the basics.

What to do now

  1. Treat backup servers as tier zero. Restrict who can administer Veeam and its database, scope backup service accounts per domain, and keep immutable or offline copies that no domain account can delete.
  2. Alert on new domain trusts. Trust creation and netdom trust commands are rare on a healthy estate; put them behind change control and alert on every instance.
  3. Separate privileged accounts by domain. Do not store admin credentials for several domains in one system, and audit domain admin groups for look-alike names.
  4. Close visibility gaps. Inventory unmanaged hosts and deploy endpoint protection with tamper protection everywhere, in line with the Cyber Essentials malware protection control.
  5. Retire unsupported systems. Windows 10 and Server 2012 R2 fall foul of Cyber Essentials security update management; plan replacement now.
  6. Restrict remote administration. Only known management hosts should be able to use WMI, remote registry, remote scheduled tasks or ADMIN$ shares; and alert on registry hive saves outside approved jobs.
  7. Hunt for the published indicators. Bitdefender has released IOCs, including the account names and probe artefacts described above.

Bottom line

A UK school estate lost most of its machines to a commodity encryptor after an attacker walked through backup credentials and newly built domain trusts. The suspected AI help is worth tracking, but it changed the shape of the logs, not the outcome. The controls that stop ordinary ransomware would have stopped this too.

Sources

Related Posts