Hackers use AI-style automation to launch ransomware on UK schools

A hybrid approach to cybercrime

A ransomware affiliate recently targeted a UK school estate, using a method that combines human oversight with AI-style automation. The group responsible, known as 3AM or ThreeAM, typically sells its Rust-based ransomware to affiliates who perform the actual break-ins. This specific operation resulted in the encryption of 37 machines across the school's network.

Researchers at Bitdefender identified the attack as a hybrid operation. In this model, a human operator selects the primary goals and targets, while a language model appears to handle the repetitive, tedious work. This allows the hackers to move through a network more efficiently by automating the troubleshooting of failed commands.

The attackers were able to navigate the school's infrastructure, which consisted of 47 systems including 21 servers and 10 workstations running Windows 10. By using a mix of human strategy and automated execution, the group was able to move through several separate Active Directory domains that were not originally connected to one another.

Stealing credentials and blending in

The breach began on September 10 and 11 when the attackers stole passwords from three backup servers. They achieved this by using a modified public Veeam script, highlighting why backup software remains a high-priority target for cybercriminals. Once inside, they began creating fake administrative accounts to maintain their presence.

To avoid detection, the hackers named their new domain admin accounts 'library' and 'svc_bkpmon.' These names were specifically chosen to blend in with the existing account lists of a school environment. By mimicking standard naming conventions, the attackers hoped to fly under the radar of basic security monitoring tools.

After securing their foothold, the group moved 40 finance files through the Windows registry to a server they controlled on September 15. They also used a tool called Mimikatz, which they renamed to 'sysmon64.exe' to further disguise its purpose. These tactics allowed them to gather sensitive information while staying hidden within the network for several days.

Signs of AI-driven automation

The clearest evidence of AI involvement occurred on September 13. Researchers noticed a specific pattern where the attacker ran a command, waited about 41 seconds, and then ran the exact same command again. This cycle of retrying failed tasks every 40 to 101 seconds is a hallmark of a model handling repetitive work rather than a human typing manually.

The commands also contained specific errors that suggest a model was writing from memory. For example, one call to the Veeam software used the incorrect port and login method. Additionally, the attackers left behind 'Bash-style' escape characters inside Windows commands on three different days, which is an unusual technical quirk for a standard manual attack.

The attackers also performed 'fiddly' setup work, such as joining three domains with two-way trusts using built-in tools. Bitdefender noted that this type of configuration work, where an error message points directly to the next fix, is a task that suits an AI model well. The group even left behind numbered script versions like 'av_remove' and 'av_remove2' during their process.

The final encryption and impact

On September 19, the attackers attempted to remove security software from the school's file server. However, the system's anti-tampering controls successfully blocked this action. Despite this hurdle, the group proceeded to launch the ThreeAM encryptor, a file named 'host.exe,' between 05:07 and 05:33 UTC.

The encryption process was remarkably fast, taking only 12 to 13 seconds per machine. As the software encrypted the data, it also deleted system-state backups to prevent the school from easily restoring their files. This rapid execution is a common trait of modern ransomware designed to maximize damage before defenders can intervene.

While Bitdefender noted that the toolkit used in this specific attack was old, they warned that hybrid attacks are expected to become more common by 2027. They emphasized that AI-run intrusions are often noisy because they leave behind repeated commands and probe files. This pattern has been seen in other campaigns, such as the JadePuffer and Aur0ra ransomware cases.

Defensive takeaways for schools

To defend against these types of hybrid attacks, Bitdefender recommends several specific security measures for organizations. One primary recommendation is to keep administrative accounts for separate domains completely apart. They also advise monitoring for any new domain trusts or the use of the 'netdom' tool, which attackers used to link different parts of the school network.

Organizations should also prioritize the protection of backup servers. It is critical to keep copies of backups that cannot be deleted by any standard domain account. Furthermore, administrators should limit access to the remote registry and 'ADMIN$' shares to only known, authorized management hosts to prevent lateral movement.

Finally, the researchers suggest putting an endpoint agent on every single machine to provide full visibility. Because AI-driven attacks can be noisy, security teams should look for repeated commands and numbered scripts as potential indicators of a compromise. Staying alert to these specific automated behaviors can help stop an incident before the final encryption phase begins.