In the 3AM ransomware UK school case, Bitdefender researchers say an affiliate reached nearly 50 machines from an unmanaged host and encrypted about 37 of them in the final stage of activity dated September 10 to 19. The agentic loop claim rests on commands that changed slightly between attempts and arrived every 40 to 100 seconds. Researchers never had the attacker's machine, so the model, the runtime, and any copy-paste step are unknown.
Key takeaways
- A 3AM affiliate encrypted about 37 of nearly 50 machines at an unnamed UK school estate, starting from an unmanaged host.
- The agentic-loop label is a hypothesis from command behavior. Bitdefender never recovered the operator machine or a model.
- The affiliate stole Veeam and Windows credentials, created domain admins library and svc_bkpmon, and built two-way trusts across three previously separate AD domains.
- The UK NCSC urges critical infrastructure to prepare for AI-powered ransomware by 2028.
What did Bitdefender observe in the 3AM ransomware UK school case?
Bitdefender describes a 3AM ransomware affiliate at an unnamed UK school estate. About 37 of nearly 50 machines reached from one unmanaged host were encrypted. The figure counts one estate, not UK schools nationally.
Activity is dated September 10 to 19, with no year printed. Initial access is unknown: the write-up names no vulnerable service, phishing lure, or exposed edge device.
Why does the command pattern look like an agentic loop?
Commands returned with a small edit on each attempt, spaced roughly 40 to 100 seconds apart. That rhythm matches an agentic loop: issue a command, read the result, adjust, resend. Researchers say they could document only the behavior, and that 3AM actors appear to be experimenting heavily with AI tools.
A person pasting from a chat window, or a short retry script, can leave the same spacing. Until the operator workstation is collected, the loop stays a hypothesis. Agentic AI threat modeling tests that operator pattern without treating an unrecovered model as fact.
How did one unmanaged host reach three Active Directory domains?
Stolen credentials and new two-way trusts. The trusts are where the scope widens.
A modified public PowerShell tool extracted and decrypted credentials on three Veeam backup servers. Neither the tool nor the Veeam build is named. A Chrome credential database was copied. Mimikatz and LSASS memory-dumping tools went after Windows authentication material, and the attacker searched logon-script folders for references to other schools.
Two backdoor domain administrator accounts, library and svc_bkpmon, imitate a library account and a backup-monitoring service. Financial data was stolen; volume is not stated. The affiliate then configured two-way trusts between three previously separate Active Directory domains. Active Directory penetration testing scoped to a single domain misses that path.
What succeeded in the final stage?
The attacker tried to remove Sophos and Bitdefender from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor. Encryption succeeded on about 37 machines. Full removal of the endpoint agents is not confirmed, and no clock time is given for the first encrypted host. The research describes no ransom note, payment demand, or leak-site posting.
A domain admin can wipe backups that sit on the production domain. Isolated or immutable copies still restore the estate. A wave of Sophos or Bitdefender uninstall attempts is the other pre-encryption signal.
Where does 3AM sit next to the NCSC 2028 warning?
3AM emerged in 2023 and drew attention when an attacker deployed its Rust ransomware after LockBit was blocked on a host. Researchers later linked it to Conti and Royal, whose affiliates have used email bombing and spoofed IT support calls. Neither method is identified here. A scale marker is Kootenai Health, where an August 2024 attack exposed personal information of more than 464,000 patients.
The research note also cites the UK NCSC’s The State of the Cyber Nation, which urges critical infrastructure to prepare for AI-powered ransomware by 2028.
What should a multi-school estate check this week?
Treat the AI question as secondary. Find unmanaged hosts that can authenticate to domain controllers, Veeam servers, and file shares. Export domain admins created around September 10 to 19 and flag names like library and svc_bkpmon. Review two-way trusts added in that window and the account that created each. Check Veeam logs for credential extraction and PowerShell that decrypts stored secrets.
Confirm LSA protection and Credential Guard on domain controllers and backup hosts, and backups a production domain admin cannot delete. An assumed breach assessment that stops inside the first domain misses this trust path. For the board, record who created the admins and trusts and which backup server released the first credential. That record is the starting point for AI agent incident response.
FAQ
Did Bitdefender prove a language model ran this 3AM attack?
No. It documented behavior similar to an agentic loop but never accessed the attacker's machine, so the model, runtime, and any copy-paste workflow are unidentified.
How many machines did 3AM encrypt in the UK school attack?
About 37 of nearly 50 reached from an unmanaged host on one unnamed estate, in the final stage of activity dated September 10 to 19.
Which backdoor account names should defenders hunt?
library and svc_bkpmon, both domain admins. Also hunt any new admin imitating a library or backup role, plus the account that created the two-way trusts.
If several school domains share backup servers, an assumed breach assessment should start from an unmanaged host and follow new domain admins and trust creation through to the encryptor.