A 3AM ransomware affiliate encrypted about 37 machines at a UK school estate during an intrusion from September 10 to 19, according to an investigation published by Bitdefender on November 3. The attackers reached 47 systems, and researchers said they could not determine how the initial compromise occurred.
Bitdefender found signs that some commands may have been generated and revised through an AI-driven agentic loop. The attacker repeatedly ran commands, made small changes and retried at intervals of roughly 40 to 100 seconds. The researchers could not access the machine used by the operator, however, and said they could not identify a language model or rule out a person copying commands and results between tools. The company describes the incident as a hybrid operation involving human activity and behavior resembling an agentic loop in its technical report.
The affiliate used a modified PowerShell tool to extract credentials from three Veeam backup servers, copied a Chrome credential database and used Mimikatz and LSASS memory-dumping techniques. It created two backdoor domain-administrator accounts, established two-way trusts between Active Directory domains and attempted to remove security software before deploying the Rust-based encryptor.
The findings are more tentative about AI than a separate PaperCut campaign involving AI agents: Bitdefender said the school intrusion’s command patterns suggest possible model involvement, but direct evidence of AI use was unavailable.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
