3AM Ransomware’s Suspected AI-Assisted Attack on UK Schools, Explained

WarBrief Live | November 8, 2026 | Cybersecurity

A 3AM ransomware affiliate encrypted about 37 machines at a UK school estate in September 2026, and the investigators say part of the intrusion looks like the work of an AI agent. The AI part is suspected, not proven — and that distinction is the story.

Bitdefender published its investigation on November 3, 2026. What follows is the 3AM ransomware AI attack, explained: what the evidence actually shows, what remains only suspected, and why the case matters well beyond one school estate.

What happened in the 3AM ransomware AI attack on UK schools?

Bitdefender’s investigation, written by researcher Marius Baciu, describes a ransomware intrusion that ran from September 10 to 19, 2026, against a school estate in the UK. Bitdefender attributes the break-in, with confidence, to an affiliate of 3AM. The organisation has not been named. Bitdefender’s headline refers to “European schools”, but the body of its write-up places the victim in the UK, and the trade press has reported it as a UK school estate.

The estate held 47 systems, including around 21 servers, eight of them domain controllers, ten Windows 10 workstations that have been out of support since October 2025, and one domain controller still running Windows Server 2012 R2. The attacker stole finance data from compromised machines, then, on the morning of September 19, ran the 3AM encryptor from 05:07 to 05:33 UTC, taking 12 to 13 seconds per machine and deleting system-state backups as it went. About 37 machines were encrypted.

Two things remain unknown, and Bitdefender is explicit about both. First, the firm could not establish how the affiliate first got in — the initial access method is not documented. Second, as of November 3, no leak-site listing tied to the attack had surfaced, according to the threat-intelligence firm CyPro, so there is no public sign of a ransom negotiation or of stolen data being published. BleepingComputer’s report of the investigation records the same limits: the intrusion is documented in detail, but the entry point and the ransom outcome are not.

How did the attackers move from one school to the next?

The break-in followed a familiar ransomware playbook, executed patiently over nine days. On September 10 and 11, the attacker used a modified public PowerShell tool to read and decrypt credentials stored on three Veeam backup servers, and copied a Chrome database holding saved passwords from a terminal server. Backup credentials, in other words, were the keys to the estate.

On September 12 and 13 came reconnaissance: the attacker tested connections, tried to add a Defender exclusion, downloaded the credential-dumping tool Mimikatz from its public GitHub release, and confirmed domain administrator rights. The attacker then created two backdoor domain administrator accounts, named “library” and “svc_bkpmon” to blend in with legitimate service accounts, and mapped the relationships between the estate’s separate Active Directory domains, searching logon-script folders for references to other schools.

On September 18, in about three hours, the attacker linked three previously separate domains with two-way trusts and pushed the backdoor account’s access across the estate. That is the step that turned a single-school compromise into a multi-school incident: once the domains trusted each other, the attacker could move between schools using the same stolen credentials.

The final stage came on the morning of September 19. Attempts to remove Sophos and Bitdefender protection from reachable hosts were blocked by the products’ anti-tampering controls — a rare defensive win in this incident. The attacker proceeded anyway, deleted system-state backups, and deployed 3AM’s Rust-based encryptor. In 37 cases, the encryption succeeded.

What made Bitdefender suspect an AI agentic loop?

The intrusion’s tools were ordinary. What looked unusual was the rhythm of the hands-on work. Bitdefender found commands carrying errors typical of writing from memory rather than from a manual: a call to the Veeam backup software’s web interface used port 9392 with basic authentication, when Veeam’s own documentation uses port 9419 and OAuth2 tokens. The commands also arrived with numbered script revisions, self-labelled output and confirmation files — the hallmarks, in Bitdefender’s reading, of a model generating and revising its own work.

The timing told the same story. On September 13, the attacker ran a PowerShell command, re-ran it unchanged 41 seconds later, changed a single call 49 seconds after that, and then, 47 seconds later, abandoned PowerShell for wmic, the older command-line interface to Windows Management Instrumentation. Retries came every 40 to 101 seconds regardless of how much the command had changed, while moving on to a new task took minutes. A human operator, Bitdefender argues, would not retry at such a steady pace, nor take minutes to switch tasks and seconds to retry the same one.

“What this attack does show is that the hybrid approach works, and we assess that it makes economic sense for attackers, with a person setting the goals and an [AI] model handling the mechanical work. We can expect hybrid attacks like this one to become more common in 2027.”

That is Bitdefender’s assessment, quoted by Infosecurity Magazine — a forecast, not a measurement. And the firm pairs it with blunt caveats. It never saw the machine the attacker worked from, an unmanaged host with no security agent installed, so it cannot say which model was used, where it ran, or whether a person was simply pasting output into a chatbot. Bitdefender calls the case “one case, an anecdote, and not a trend”, says it found nothing novel in the tooling, and presents the hybrid reading as “the working model defenders should plan around, not as an established fact”. It also notes this is the first case of its kind that it has documented in Europe.

What is an agentic loop — and what is it not?

An agentic loop is software that feeds each command’s result back to a language model, which then proposes the next command, and repeats the cycle until the goal is reached or the loop stalls. In this case, the loop would have handled the repetitive work — generating commands, reading the errors, tweaking and retrying — while a human operator set the objectives and made the strategic calls, such as which domain to bridge next.

It is worth separating the three claims, because they carry very different levels of proof. That a language model wrote the commands is strongly supported by their content — the memory-style errors and the revision pattern. That an agentic loop chose each next action behaves like one, but cannot be distinguished from a person copying commands and results between a shell and a chat window. And that no human was involved is not supported by the telemetry at all: Bitdefender’s own evidence shows a human choosing the goals throughout.

So this was not a confirmed autonomous attack, and no AI product, model name, version or vendor has been identified — nothing here implicates any specific chatbot or coding assistant. WarBrief has previously examined Phantom, a framework built around AI agents running ransomware intrusions, a different case in which the AI role was built into the tooling rather than inferred from behaviour. The 3AM school case is the reverse: the tooling was conventional, and only the behaviour hints at a model.

What is 3AM ransomware, and who runs it?

3AM, also written ThreeAM, is a ransomware-as-a-service operation. The core group develops the encryptor — a Rust-based sample, first observed in February 2023 — and leases it to affiliates who carry out the break-ins and share the proceeds. It came to public attention when an attacker deployed its ransomware after a LockBit attack was blocked, and researchers have since linked the operation to the Conti and Royal ransomware gangs. Affiliates have been observed using email bombing and spoofed IT support calls to get into corporate networks.

The most notable past victim is Kootenai Health in the United States, where an August 2024 attack exposed personal information belonging to more than 464,000 patients. The school estate is a smaller target, but the pattern is the same: a professional affiliate operation, an established encryptor, and an intrusion that relies on stolen credentials rather than a novel exploit.

Enforcement against this kind of crime is slow and international. INTERPOL’s Operation Serengeti III arrested 1,462 people across Africa in a single sweep, a reminder of the scale of the affiliate economy — but no arrests have been reported in the school estate case, and the affiliate behind it has not been identified.

3AM ransomware AI attack, explained: by the numbers

Figures marked CONFIRMED appear in Bitdefender’s published investigation or the NCSC’s annual review; REPORTED items are single-source, explicitly unconfirmed, or unknown.

What the 3AM school attack means for US/UK/EU readers

For UK readers, the warning is direct: a school estate was breached through its backup systems, and the attack spread because separate school networks trusted each other. Parents and staff at schools running similar setups — shared backup servers, old Windows machines, linked domains — are looking at the same exposure. There is no evidence that US or EU schools were hit in this incident, but the playbook is borderless: ransomware affiliates are global, the tools are public, and the weaknesses are the same in every country.

For US and EU readers, the wider signal is the NCSC’s forecast. The UK’s National Cyber Security Centre, part of GCHQ, published its State of the Cyber Nation review on November 3, 2026, the same day as Bitdefender’s report. It judges it “highly likely” that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure by 2028 — energy, water, transport and health services. In the year to August 31, 2026, the NCSC received 1,831 cyber incident reports and supported responses to 337 of them, 80 of which were classed as nationally significant. Tech Insider’s summary of the review notes the agency expects Russia, China and other states to use AI routinely in cyber operations by 2028, while criminal groups exploit similar technology to scale up ransomware, social engineering and vulnerability exploitation. Unpatched flaws remain a common way in — the Ivanti zero-day chain WarBrief covered this week gave attackers unauthenticated root access through three flaws.

The cost of this kind of attack is not only the ransom, which in this case is not even known to have been demanded. It is the recovery: rebuilding 37 machines, restoring from backups that the attacker tried to delete, re-issuing credentials across three domains, and the disruption to teaching while systems are down. For public-sector networks, that bill lands on taxpayers.

What schools and small networks should do now

Bitdefender’s own defensive lessons are practical rather than exotic, and they apply to any small network, not only schools. Protect backup servers like domain controllers: the Veeam credential theft was the pivot point of the whole intrusion, so backup credentials should be scoped to each domain and monitored like the keys they are. Alert on Veeam credential access and on the creation of rogue administrator accounts, and alert on new domain trusts — the September 18 trust-bridging was the moment one school’s problem became three schools’ problem.

Keep offline backups that ransomware cannot delete, and test recovery copies that domain administrators cannot reach. The attacker’s attempt to delete system-state backups would have been far more damaging if the estate had relied on those copies alone. Retire out-of-support systems: ten Windows 10 workstations past their support date and a Windows Server 2012 R2 domain controller were in the estate, and unsupported systems are the easiest foothold to keep. And keep endpoint protection’s anti-tampering switched on — it was the one control that held, blocking the attempt to strip Sophos and Bitdefender from the estate’s machines.

What to watch next in AI-assisted ransomware

The question now is whether the 3AM school case is a one-off or the first documented instance of a pattern. Bitdefender expects hybrid attacks to become more common in 2027; the NCSC’s 2028 horizon points the same way. What would confirm the trend is a second documented case — ideally one where investigators recover the operator’s machine and can identify the model, or where a vendor’s telemetry shows the loop directly. Until then, “suspected AI-assisted” is the honest label, and headlines claiming an autonomous AI attack overstate the evidence.

Watch, too, for the NCSC’s incident figures over the coming year, and for whether other vendors report the same retry-timing signature in their own cases. State-backed intrusions use different tradecraft — for a contrast, see WarBrief’s report on APT29’s “Poisoned Source” watering-hole campaign — but the criminal affiliate economy is where AI assistance is likely to show up first, because it is where the repetitive work is cheapest to automate. WarBrief’s intelligence reporting will track both tracks as new cases are published.

Frequently asked questions

What is 3AM ransomware?
3AM, also written ThreeAM, is a ransomware-as-a-service operation. Its core group builds a Rust-based encryptor, first observed in February 2023, and leases it to affiliates who break into networks and share the proceeds. Researchers have linked the operation to the Conti and Royal ransomware gangs.

Did AI run the attack on the UK schools?
No — that has not been confirmed. Bitdefender says parts of the intrusion behaved like an AI agentic loop, with a human setting the goals and something resembling a model handling the retries. The firm could not identify any model, and it cannot rule out a person copying commands between a terminal and a chatbot.

How did the attackers get into the school estate?
That has not been established. Bitdefender could not determine the initial access method. What is documented is what happened after entry: credential theft from Veeam backup servers, the creation of backdoor administrator accounts, and the bridging of three Active Directory domains.

What is an agentic loop?
It is software that feeds each command’s result back to a language model, which proposes the next command, and repeats the cycle until the goal is reached or the loop stalls. In the 3AM case, the loop is suspected of handling repetitive command generation and troubleshooting while a human operator made the strategic decisions.

Was any ransom paid, or was data published?
Neither has been reported. As of November 3, 2026, no leak-site listing tied to the attack had surfaced, so there is no public sign of a ransom negotiation or of stolen data being published.

Sources

• Bitdefender: 3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop
• BleepingComputer: UK school estate hit by 3AM ransomware in suspected AI-assisted attack
• Infosecurity Magazine: 3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compromise
• SecNews: 3AM ransomware hits UK school estate in suspected AI-assisted attack
• Hackread: 3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack
• Tech Insider: AI Malware Will Hit UK CNI by 2028, NCSC Warns [2026]