Ransomware · 4h ago
BleepingComputer reports that a 3AM ransomware affiliate encrypted about 37 of nearly 50 machines it reached from an unmanaged host in a UK school estate.
The attackers stole backup credentials, created rogue domain-admin accounts and used ordinary Windows tools to establish trusts between previously separate Microsoft Active Directory domains. Those connections let them move from one school to others. Bitdefender assessed that an AI system may have generated and revised repetitive commands and helped troubleshoot, while a human chose the goals and directed the intrusion.
For school estates that connect separate Windows domains through trusts, a compromise on one unmanaged machine can become a route into others. The reporting leaves the AI contribution uncertain; the trust and credential paths, by contrast, account for how the attack spread.
2 sources covering this story
UK school estate hit by 3AM ransomware in suspected AI-assisted attack
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.
3AM Affiliate Used AI-Like Loops in European School Attack
How a 3AM ransomware affiliate used domain trusts, stolen credentials, and possible AI-driven command loops in a breach of UK schools.
Part of the PlainSec briefing for 2026-11-03