3AM Ransomware Attack on UK Schools Shows Signs of AI Assistance

A 3AM ransomware affiliate encrypted approximately 37 machines out of nearly 50 on a UK school estate. Bitdefender researchers identified patterns suggesting AI-assisted operations: commands were issued at regular 40-100 second intervals with minor modifications each time. The researchers could not access the attacker’s device to verify which AI model was used or how it was deployed.

The attacker stole credentials from Veeam backup servers and Chrome browsers, deployed credential-dumping tools to map the network, and created two backdoor administrator accounts. They then configured trusts across Active Directory domains to expand their reach before attempting to disable endpoint protection and deploying 3AM’s Rust-based encryptor.

3AM emerged in 2023 and is linked to operators behind Conti and Royal ransomware. Previous victims include healthcare networks with hundreds of thousands of exposed records. The apparent experimentation with AI tools aligns with recent UK government warnings that AI-powered ransomware poses a growing threat to critical infrastructure.