Summary
- A 3AM ransomware affiliate compromised a UK school IT estate, reaching approximately 50 machines and encrypting around 37.
- Command revisions arriving at intervals of 40–101 seconds showed behaviour consistent with an AI-assisted execution loop.
- Bitdefender could not examine the attacker's operating machine or identify a model, leaving the mechanism unconfirmed.
A ransomware attack against British schools displayed behaviour consistent with an artificial intelligence system assisting the intruder, although investigators could not establish whether a language model actually controlled the suspicious command sequences.
Cybersecurity company Bitdefender examined an intrusion attributed to an affiliate of the 3AM ransomware operation during September 2026. The attacker compromised administrative accounts, established connections between previously separate school networks, and ultimately encrypted approximately 37 systems.
Researchers identified repeated commands in which failed attempts were followed by revised instructions at relatively consistent intervals. They assess that the pattern resembles a hybrid operation, with a human choosing objectives and an automated system handling some of the repetitive technical work.
However, the machine used to direct the intrusion was outside the investigators’ monitoring coverage. They could observe commands reaching protected systems but could not identify the mechanism generating them, determine which model might have been involved, or exclude manual interaction with an AI assistant.
Command revisions suggest an automated loop
The suspicious sequences were identified within a broader attack that relied heavily on ordinary Windows administration tools. Rather than deploying an entirely new collection of offensive software, the intruder used existing system utilities and publicly available tools to investigate the environment and extend access.
This approach, commonly described as living off the land, allows malicious operations to resemble legitimate maintenance activity. Administrators routinely use Windows utilities to manage accounts, inspect systems, and operate remote services, making the context and sequence of actions important when investigating a possible intrusion.
On 13 September, the attacker repeatedly revised a PowerShell command after unsuccessful attempts. One instruction was repeated 41 seconds after the previous attempt, followed by another modification 49 seconds later and a change to a different Windows utility after a further 47 seconds.
Across nine observed retries, the intervals ranged from approximately 40 to 101 seconds, despite substantial differences in the complexity of the revisions. Moving between separate tasks generally took several minutes, creating a contrast between relatively rapid retries and slower changes in the direction of the attack.
Bitdefender considers this pattern compatible with an arrangement in which a model receives the result of a command and proposes another attempt, while a human operator determines the broader objective.
Some commands also contained technical inaccuracies resembling those produced when a language model generates instructions from incomplete knowledge. In one case, an attempt to interact with backup software used a port and authentication method that did not match the vendor’s documented interface.
Other scripts included numbered revisions and confirmation files. These characteristics supported the researchers’ interpretation, although none independently proves that an automated model selected or executed the commands.
A human operator could have copied results into an AI assistant and manually entered its suggestions, while conventional scripting and repeated manual troubleshooting could produce some similar evidence.
The researchers therefore describe the hybrid explanation as a working interpretation rather than an established reconstruction of the attacker’s tools.
Compromised accounts connected separate school networks
The affected environment contained several Windows Active Directory domains, each maintaining its own accounts and administrative arrangements. The domains had initially been separate, limiting the extent to which credentials from one environment could be used elsewhere.
During reconnaissance, the attacker examined account permissions, identified other school networks, and investigated the relationships between domains. The intrusion also involved access to backup infrastructure, which can contain sensitive credentials and information about other systems.
The attacker subsequently established trust relationships between three domains. A domain trust allows recognised accounts from one administrative environment to authenticate in another under defined conditions.
Such connections have legitimate uses when organisations need shared access to resources, but unauthorised changes can substantially increase the reach of compromised credentials.
In this case, the intruder had already created privileged accounts within multiple domains. The additional trust relationships were followed by attempts to extend administrative access across the school estate.
Approximately 50 machines were reached from an unmanaged host, and around 37 were encrypted the following morning. The resulting cross-domain encryption is consistent with the trusts having functioned, although Bitdefender does not treat the outcome as definitive proof that every connection operated as intended.
The investigators could not establish how the attacker initially entered the environment. They also identified earlier suspicious events whose relationship to the September attack remains uncertain, preventing a complete reconstruction of the intrusion’s initial stages.
Conventional weaknesses enabled the damage
Although the possible AI component attracted attention, the operational techniques were familiar. The intrusion involved stolen credentials, privileged accounts, remote administration, backup-system access, and attempts to interfere with endpoint protection.
These methods can allow ransomware operators to move between systems once they establish sufficient access, regardless of whether commands are written manually or generated with software assistance.
Backup infrastructure is particularly sensitive because management systems may contain credentials or permissions extending across numerous machines. An attacker who compromises those services can gain access to resources beyond the original entry point.
The domain changes also created opportunities for detection. New trust relationships are comparatively unusual in established school networks and should normally be associated with documented administrative work.
Monitoring such modifications can help investigators identify attempts to extend access, especially when the changes occur alongside new privileged accounts, unusual remote activity, and modifications to security software.
However, detecting suspicious commands does not automatically determine whether a language model produced them. Security systems must distinguish unauthorised activity from legitimate administration using the available context rather than assuming that rapid or repetitive commands establish AI involvement.
The unmanaged machine directing the attack created a substantial visibility gap. Because it lacked the monitoring available on protected endpoints, investigators could examine only the resulting activity observed elsewhere in the network.
That limitation was central to the uncertainty surrounding the suspected automated component. The telemetry showed what commands arrived and when, but not how they were generated or selected.
One incident cannot establish an industry trend
Bitdefender describes the case as its first documented European investigation showing this particular combination of human and apparently agent-like attacker behaviour. The company explicitly cautions against treating the finding as evidence of widespread AI-operated ransomware attacks.
Its wider investigations continue to show attackers relying predominantly on conventional methods. AI-generated malware accounted for approximately 0.07% of the malicious samples the company collected each month, according to its research.
Nor was the observed intrusion exceptionally fast. Even the quickest retries took around 40 seconds, while the broader operation unfolded over several days using familiar tools and established ransomware techniques.
The potential significance lies in how automation might reduce the effort required to repeat technical procedures, interpret errors, and adapt commands within unfamiliar environments.
If attackers can delegate those mechanical tasks, human operators may be able to concentrate on choosing targets and deciding which systems to compromise. The extent of any resulting improvement in speed or cost remains unmeasured in this investigation.
For the schools involved, the confirmed outcome was compromised access and encrypted systems. The possible contribution of AI remains unresolved, but the incident demonstrates why investigators need records of actual system activity when evaluating claims about increasingly automated cyberattacks.
