Security firm Bitdefender says a ransomware affiliate using the 3AM encryptor broke into a UK school estate in September and may have used a language model to handle repetitive work. The firm calls it a hybrid of a human operator and a suspected AI loop, but says it cannot prove that. The defensive lessons are ordinary ones, which makes them easy to act on.
What happened
According to reporting on Bitdefender’s findings, the attacker worked inside an estate of 47 systems spread across separate Active Directory domains. Early activity included stealing credentials from backup servers, copying browser credential data, running Mimikatz under the disguised file name sysmon64.exe, and creating two rogue administrator accounts named “library” and “svc_bkpmon”.
On September 18, the attacker created two-way trusts between the separate domains, giving one set of stolen access reach across the whole estate. Attempts to remove endpoint protection were blocked by anti-tampering controls. The Rust-based 3AM encryptor then ran, deleting system-state backups as it went. Hackread reports about 37 machines were encrypted; the other coverage we reviewed does not give that figure.
The AI angle rests on timing. Failed commands were retried at intervals of 40 to 101 seconds, and large script rewrites arrived as fast as small tweaks. One request to a Veeam backup interface used a port and sign-in method that Veeam’s documentation does not describe. Bitdefender reads this as consistent with a model suggesting fixes while a person set direction.
Why it matters
Bitdefender is quoted as saying it could not confirm whether a model ran the loop automatically or an operator copied commands between a terminal and an AI tool. It also called the case an anecdote rather than a trend. The tools used were mostly built-in Windows components such as PowerShell, WMI and registry utilities, so nothing here is a new malware technique. Because Bitdefender sells security services, treat its framing as one vendor’s interpretation.
What does stand out is that the actions that mattered, such as new domain trusts, new admin accounts and backup credential access, are rare events that defenders can alert on.
What to do
- Alert on any new Active Directory trust and on creation of privileged accounts. Both should be rare in a stable environment (our analysis).
- Keep administrator accounts for separate domains distinct, so one stolen credential does not unlock every domain. Bitdefender’s reported advice is the same.
- Treat backup servers as targets: restrict who can read stored secrets, and keep at least one backup copy offline or immutable.
- Confirm every server has endpoint protection with tamper protection enabled. Here, tamper protection blocked an attempt to remove the agent.
- Block shells and scripting tools on machines that do not need them, and watch for bursts of repeated failing commands.
- Check for unexpected files named like system tools, such as sysmon64.exe in odd locations, and for admin accounts you did not create.
What we still do not know
The school estate has not been named, and the number of schools involved is not stated. The initial access method and date have not been disclosed. Reports do not say whether data was stolen, whether a ransom was demanded or paid, or which model or tool the attacker may have used. We could not open Bitdefender’s own write-up from our systems, so every detail above comes from three news reports of it, and the figures differ slightly between them.
Sources: Hackread (Nov 3, 2026); Resultsense (Nov 4, 2026); GBHackers (Nov 4, 2026). Original research: Bitdefender (Nov 3, 2026), not independently reviewed by us.
Leave a Reply