3AM ransomware crossed school domains from an unmanaged host
BleepingComputer reports that a 3AM ransomware affiliate encrypted about 37 of nearly 50 machines it reached from an unmanaged host in a UK school estate.
The attackers stole backup credentials, created rogue domain-admin accounts and used ordinary Windows tools to establish trusts between previously separate Microsoft Active Directory domains. Those connections let them move from one school to others. Bitdefender assessed that an AI system may have generated and revised repetitive commands and helped troubleshoot, while a human chose the goals and directed the intrusion.
For school estates that connect separate Windows domains through trusts, a compromise on one unmanaged machine can become a route into others. The reporting leaves the AI contribution uncertain; the trust and credential paths, by contrast, account for how the attack spread.
UK school estate hit by 3AM ransomware in suspected AI-assisted attack
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.