An affiliate behind a 3AM ransomware attack has breached a UK school estate using what researchers describe as an automated AI-style command loop to alter instructions in real time. Security firm Bitdefender tracked the intrusion between 10 and 19 September, finding evidence that the attacker encrypted 37 systems across multiple interconnected network domains.
Key points
- A 3AM ransomware affiliate compromised a UK educational estate, encrypting roughly 37 out of nearly 50 accessible computers.
- Security researchers found repetitive, machine-speed command sequences issued every 40 to 100 seconds, pointing to an iterative AI agent loop.
- The intruder harvested credentials from Veeam backups and Chrome databases before linking three separate Active Directory domains.
- The incident coincides with fresh warnings from the UK National Cyber Security Centre for critical organisations to prepare for autonomous threats.
How the iterative command loop operated
During the intrusion, telemetry showed a regular cadence of terminal commands dispatched to compromised systems at intervals of roughly 40 to 100 seconds. Each failed command returned to the operator and was reissued with minor syntax adjustments, a feedback behaviour characteristic of autonomous agentic loops driven by large language models.
Rather than relying on human speed or static scripts, the attacker appeared to feed output back into a model that altered parameters until commands executed successfully. In an analysis of the incident, Bitdefender explains the limits of external visibility during such intrusions.
“We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself,” the researchers wrote. The team could not confirm whether the language model ran locally or on a remote server, or whether an operator manually copied outputs between an implant and a chatbot interface.
Even so, the automation allowed the threat actor to adjust administrative commands without the delays usually seen when human operators consult reference manuals or manually debug terminal errors. The technique mirrors wider shifts across criminal operations, including the ARTEX AI framework deployed in automated cyberattacks across hundreds of targets worldwide.
Lateral movement and Active Directory compromise
The attacker gained an initial foothold through an unmanaged host on the school network, though investigators have not determined the exact vulnerability used. Once inside, the intruder moved quickly to secure credentials across administrative systems.
The threat actor deployed a modified public PowerShell utility to pull and decrypt stored credentials from three Veeam backup servers. They also copied local Google Chrome databases to extract stored web logins and executed Mimikatz alongside LSASS memory-dumping utilities on domain systems.
To expand reconnaissance, the intruder searched network logon scripts for references to other educational institutions in the trust. They then established persistence by creating two backdoor domain administrator accounts, labelled “library” and “svc_bkpmon”.
Financial documents were stolen from administrative workstations before the intruder consolidated network access. The attacker reconfigured trust settings between three previously isolated Active Directory domains, forging two-way relationships that allowed administrative rights on one system to carry across the entire school estate.
Neutralising defences and deploying the encryptor
In the final phase of the operation, the intruder moved to dismantle endpoint defences on all reachable systems. The actor attempted to disable and uninstall software from Sophos and Bitdefender before wiping local system-state backups to prevent network recovery.
The attacker then pushed 3AM’s proprietary Rust-based encryptor across the network. Out of nearly 50 machines reached from the unmanaged machine, the malware successfully encrypted files on 37 systems.
Rust has become a preferred language for modern ransomware syndicates because it produces cross-platform binaries that are difficult to decompile and reverse-engineer. The language also provides low-level system performance, allowing encryptors to lock target files before system administrators can terminate running processes.
The evolution of the 3AM syndicate
The 3AM operation first surfaced in early 2023. Cyber threat intelligence teams identified it as a backup payload when an affiliate failed to deploy LockBit during a corporate network intrusion.
Security analysts have traced links between 3AM and remnants of the Conti and Royal ransomware cartels. Affiliates have previously gained corporate network access using targeted email bombing campaigns and telephone support desk impersonation.
The group has a record of targeting public sector and healthcare infrastructure. In August 2024, a 3AM intrusion at healthcare provider Kootenai Health resulted in the theft of personal and medical records belonging to more than 464,000 patients.
What the attack means for network defence
The use of machine-assisted command loops against a public school network highlights how advanced attack techniques filter rapidly down to lower-resourced organisations. School networks often support diverse user groups, legacy software, and unmanaged hardware, making them vulnerable to rapid lateral movement once an attacker breaches the perimeter.
The incident landed as the UK National Cyber Security Centre published its annual review, urging critical operators to prepare for AI-powered ransomware attacks as automated exploitation tools mature ahead of 2028.
School trusts and public bodies face increasing pressure to enforce strict network segmentation between instructional and administrative systems. Security teams are also moving to limit unmanaged devices on core networks, enforce multifactor authentication on backup servers, and isolate Active Directory forests to prevent single-account domain takeover.
