3AM affiliate encrypts 37 UK school machines in suspected AI-assisted attack

This is a new development in a story we reported earlier: Bitdefender says 3AM affiliate may have used AI-like loops in UK school breach.

About 37 of nearly 50 machines at a UK school estate were encrypted by a 3AM affiliate on September 19, 2026.

The intrusion spanned September 10 to September 19, 2026, though Bitdefender could not determine the initial entry method. Every observed action originated from an unmanaged internal host running no security agent. The security firm confirmed that a 3AM ransomware affiliate carried out the intrusion. Investigators have not tied the entry point to a specific vulnerability, phishing e-mail or exposed remote-access service.

Bitdefender said the intruder may have relied on AI-generated instructions within an automated decision loop, but the company cannot confirm the language model or automation level. “What we can document is behavior, and the behavior is that of an agentic loop,” Bitdefender said. The company describes this as an analytical reading, not a confirmed finding, since its investigators never reached the attacker’s machine.

The evidence cited for suspicion involves command retries spaced 40 to 101 seconds apart, with small variations, and a single unchanged 41-second rerun on September 13, 2026. On that day, gaps between tasks were five, two, 14, 16 and three minutes. Dark Reading reported that Bitdefender saw the retry pacing fall between manual human issuance and fully automated LLM orchestration.

Bitdefender said credential theft hit three Veeam backup servers on September 10 and 11, 2026, using a modified public PowerShell script to steal and decrypt login data. The intruder also pulled a Chrome password file from a terminal server and ran Mimikatz along with LSASS memory-dumping tools, according to the company.

On September 18, 2026, the intruder ran netdom and dnscmd to link three previously separate Active Directory domains in both directions. The intruder made two hidden domain administrator accounts named library and svc_bkpmon to match the school’s existing naming pattern.

The environment consisted of several separate unconnected Active Directory domains, and the intruder searched SYSVOL logon-script folders to find names and subnets for other schools. After the trusts were created, access for the backdoor account reached about 40 machines.

The encryptor host.exe ran from 05:07 to 05:33 UTC on September 19, 2026, at a pace of about 12 seconds per machine. The encryptor removed system-state backups during the encryption of about 37 machines, a process that took roughly 26 minutes. Anti-tampering controls blocked attempts to disable Sophos and Bitdefender endpoint protection before the encryptor started.

The intruder staged about 40 finance files in Windows registry values and sent them to an attacker-controlled rcv.aspx endpoint on the unmanaged host. The files moved through another domain’s SYSVOL under svc_bkpmon, were compressed, and then sent to rcv.aspx over HTTP on the unmanaged host.

The estate held 47 systems, including about 21 servers, eight domain controllers, and ten Windows 10 workstations that passed support in October 2025. Other systems included a Windows Server 2012 R2 domain controller and devices running Windows 11.

The company said two earlier security incidents on the school’s network might or might not relate to the September 2026 intrusion. Restricted Admin mode was turned on across four machines on January 23, 2026, in one earlier event. A separate event involved a hand-typed interactive session on June 5, 2026.

The firm said 3AM ransomware emerged in February 2023, runs as a ransomware-as-a-service operation, and researchers have tied it to the Conti and Royal gangs. Cyber Security News said 3AM usually targets small and mid-sized victims.

The firm called this a first-of-its-kind European case but described it as one isolated example, not a trend. The company expects hybrid human-AI attacks to spread further in 2027, with AI-written vibeware making up about 0.07 percent of monthly malware samples.

The firm described “machine speed” as a marketing phrase for costly frontier-scale incidents and said local-model attacks would appear slower. The company called the intrusion unremarkable because it relied on built-in Windows tools, several public utilities, and a standard encryptor.

The UK NCSC released The State of the Cyber Nation report on November 3, 2026. The agency said AI-driven malware is very probably bound for Britain’s essential services in a ransomware strike by 2028. Richard Horne, the NCSC chief executive, warned of a possible rise in cyber incidents and said AI has not created new attack methods.

The firm recommends alerting on new domain trusts, separating administrator credentials across domains, and installing endpoint protection on every machine, including unmanaged hosts. It also advises protecting backup servers with copies no domain account can delete. The firm also recommends limiting WMI, remote registry, and ADMIN$ access to known administrative hosts.

The firm also recommends removing script interpreters and shell access from endpoints that do not need them. The company said a new domain trust is an uncommon change on a healthy network and costs little to monitor.

It remains unknown what other data left the network, whether student or parent records were taken, and whether any ransom demand existed. How the attacker got in has not been identified, and investigators found no confirmed tie to a specific vulnerability, phishing email or exposed remote-access service. By November 3, 2026, no public disclosure included attacker network locations, domain names, or malware file hashes tied to the incident.