Hackers Deploy AI-Driven Tools to Launch Overnight Ransomware Attacks Against UK Educational Institutions

A ransomware operation linked to the 3AM (ThreeAM) ransomware group has targeted a cluster of schools in the United Kingdom using a blend of traditional hands-on intrusion techniques and apparent AI-assisted automation. The attackers combined legitimate Windows administration tools, stolen backup credentials, and covert administrator accounts to move laterally across the environment before encrypting dozens of systems.

The 3AM ransomware family is a Rust-based malware strain offered through a ransomware-as-a-service (RaaS) model. Under this arrangement, affiliates conduct the intrusions while sharing a portion of their profits with the operators behind the malware. Historically, the group has focused primarily on small and medium-sized organizations.

Security researchers at Bitdefender analyzed the incident and believe the attack represents a new form of hybrid intrusion. Their assessment suggests that while a human operator directed the overall campaign, an AI-powered assistant or large language model may have been used to execute repetitive tasks, troubleshoot failed commands, and automate portions of the attack workflow.

Although the evidence points toward AI involvement, researchers stress that they cannot definitively identify the specific model used or determine whether the attacker interacted directly with an AI system or manually copied outputs between tools.

Attack Began Inside a UK School Environment

The targeted educational organization operated a network consisting of 47 systems, including approximately 21 servers, eight of which served as domain controllers, alongside ten Windows 10 workstations.

The environment was initially segmented into multiple independent Active Directory domains with no direct trust relationships between them. Investigators were unable to establish precisely how the attackers first gained access.

The earliest observable malicious activity occurred on September 10 and 11, when the threat actors extracted credentials from three backup servers using a modified version of a publicly available Veeam script. Backup infrastructure remains a high-value target for ransomware operators because compromising it can significantly reduce an organization's ability to recover encrypted data.

Following this, the attackers deployed Mimikatz, disguising the tool as sysmon64.exe to avoid suspicion. They also created two rogue domain administrator accounts named:

• library
• svc_bkpmon

The naming convention appeared intentionally chosen to resemble legitimate school service accounts and blend into normal administrative activity.

Sensitive Data Stolen Before Encryption

On September 15, the attackers collected and exfiltrated approximately 40 financial documents. Rather than relying on sophisticated malware, they reportedly leveraged the Windows Registry as part of the data transfer process before sending the files to infrastructure under their control.

Researchers identified the strongest indicators of AI-assisted activity on September 13, when command execution patterns exhibited unusual consistency.

During one sequence:

• A command was executed.
• The same command was retried 41 seconds later.
• A modified version appeared 49 seconds afterward.
• Another tool was introduced 47 seconds later.

Throughout the operation, failed commands were typically retried every 40 to 101 seconds, while transitions between larger objectives occurred over several minutes.

Bitdefender believes this pattern reflects a division of labor in which a human operator selected objectives while an AI agent handled troubleshooting and repeated command execution.

Signs of AI-Generated Command Activity

The investigation uncovered several technical mistakes that resembled errors commonly produced by AI systems generating commands from memory rather than direct testing.

Examples included:

• Incorrect Veeam connection parameters.
• Use of the wrong authentication method.
• Bash-style escape sequences inserted into Windows command syntax.

Researchers also discovered numerous testing artifacts and development remnants, including files named:

• psexec-ok
• da_proof.txt

They additionally found multiple script revisions such as:

• av_remove
• av_remove2
• av_remove3

According to Bitdefender, these traces suggest a trial-and-error workflow consistent with AI-assisted command generation and iterative refinement.

Attackers Connected Multiple School Domains

On September 18, the attackers escalated their reach throughout the environment by establishing two-way trust relationships between three previously isolated Active Directory domains.

To accomplish this, they relied entirely on built-in Microsoft utilities, including:

• netdom
• dnscmd

The threat actors also examined shared network resources to identify references to additional schools and related network infrastructure.

Researchers noted that this type of configuration-heavy activity is particularly well-suited to AI assistance because error messages often provide enough context for a model to generate corrective actions automatically.

Encryption Phase Launched Before School Hours

On September 19, the attackers attempted to disable endpoint security solutions installed on the organization's file servers. However, built-in anti-tampering protections successfully prevented some of those efforts.

Despite those failures, the attackers proceeded with deployment of the ThreeAM ransomware payload, disguised as host.exe.

The encryption phase occurred between 05:07 and 05:33 UTC, likely chosen to maximize operational disruption while minimizing the chance of real-time detection.

The ransomware spread efficiently, affecting systems at a rate of roughly one machine every 12 to 13 seconds.

In total, approximately 37 devices were encrypted.

The malware also removed system-state backup data during execution to hinder recovery efforts and increase pressure on the victim organization.

What Makes This Incident Important

Bitdefender cautions against viewing this case as proof that fully autonomous AI-driven ransomware operations have arrived.

Researchers observed that:

• The tools used were largely conventional.
• The ransomware variant was not new.
• No advanced exploitation techniques were required.
• Human operators still appeared responsible for strategic decisions.

Nevertheless, the company believes similar AI-assisted ransomware intrusions could become increasingly common throughout 2027, as threat actors seek to automate repetitive elements of attack operations.

An interesting finding was that the AI-assisted components created substantial noise within the environment. Frequent retries, test files, temporary scripts, and multiple script iterations generated numerous forensic artifacts that defenders could potentially detect.

Part of a Larger Emerging Trend

The incident mirrors patterns observed in other recent attacks where AI technologies appear to have supported cybercriminal activity.

Researchers pointed to similarities with:

• JadePuffer, a campaign in which AI agents were reportedly used to coordinate significant portions of a ransomware and extortion operation.
• Aur0ra ransomware, where attackers leveraged AI-powered coding assistants such as Cursor to automate network reconnaissance, scripting, and execution tasks.

These examples suggest attackers are increasingly adopting AI not to replace human operators entirely, but to accelerate common administrative and troubleshooting tasks during intrusions.

Defensive Recommendations

Based on the findings, Bitdefender recommends several measures to reduce exposure to similar attacks:

Identity and Active Directory Security

• Keep privileged accounts isolated across separate domains.
• Monitor closely for newly created domain trust relationships.
• Generate alerts whenever tools such as netdom are executed unexpectedly.
• Audit the creation of administrator accounts with unusual naming patterns.

Backup Protection

• Harden Veeam and other backup platforms.
• Maintain immutable or offline backup copies.
• Ensure no standard domain account can delete all backup sets.

Lateral Movement Controls

• Restrict Windows Management Instrumentation (WMI) access.
• Limit Remote Registry usage to approved management systems.
• Control access to administrative shares such as ADMIN$.
• Enforce network segmentation between critical services.

Endpoint Protection

• Deploy endpoint detection and response (EDR) tools across every server and workstation.
• Enable anti-tampering protections.
• Monitor for unauthorized execution of credential theft tools such as Mimikatz.

The attack highlights how cybercriminals are beginning to blend human expertise with AI-assisted automation, creating ransomware operations that are faster, more persistent, and potentially more scalable than traditional attacks while still leaving many detectable traces behind.