UK school estate hit by 3AM ransomware in suspected AI-assisted attack

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.

Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.

The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds.

"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," Bitdefender explains.