A ransomware attack against a UK school encrypted 37 machines. It spread across three previously separate networks, with researchers identifying signs that the attackers may have used AI to support parts of the intrusion.
According to an investigation by Bitdefender, a 3AM ransomware affiliate stole credentials, created privileged accounts, and established trust relationships between Active Directory domains to expand its access. The attackers also attempted to disable endpoint security protections and deleted system-state backups before deploying ransomware.
A Bitdefender investigation uncovered evidence suggesting the attacker may have used AI during the intrusion. Although details of how AI supported the attack remain unconfirmed, the incident is the latest example of attackers leveraging AI to compromise already vulnerable systems rapidly.
What is the 3AM ransomware group, and how does it operate?
The 3AM threat group, also known as ThreeAM, is a ransomware group that emerged in 2023. The group attracted attention after an attacker successfully used its malware to encrypt a machine after failing to deploy LockBit ransomware.
The group operates under a ransomware-as-a-service (RaaS) model, in which developers maintain the malware while affiliates conduct intrusions and deploy the encryptor. In January 2024, researchers at Intrinsec identified infrastructure and operational overlaps between 3AM, the Conti cybercrime syndicate, and Royal, later known as BlackSuit, suggesting connections within the broader ransomware ecosystem.
In the UK school incident, Bitdefender attributed the intrusion to a 3AM affiliate based on analyzing the ransomware encryptor and other attack characteristics.
How this particular attack unfolded
While AI isn’t part of what the 3AM group is primarily known for, the technology has become an indispensable tool for attackers, and 3AM affiliates are suspected of using it in this operation.
According to Bitdefender’s report, the attack occurred between Sept. 10 and 19, 2026. How the affiliates gained access remains unknown.
After gaining access, researchers found that the affiliates used a modified PowerShell script to extract stored credentials. They also copied a Chrome database containing saved passwords, targeted LSASS memory, obtained additional authentication data, created two backdoor administrator accounts, and mapped the school's network.
The affiliates also collected financial documents and established two-way trust relationships between three previously separate Active Directory domains.
On Sept. 19, the affiliates tried to remove Sophos and Bitdefender endpoint protection but were blocked by anti-tampering protections. They were able to delete Windows system-state backups and deploy the 3AM ransomware encryptor, successfully encrypting about 37 machines.
Where AI may have played a role
Bitdefender researchers identified unusual command-execution patterns during the intrusion, including repeated attempts to run slightly modified commands at intervals ranging from approximately 40 to 101 seconds.
The researchers suggested that the behavior could be consistent with an agentic AI loop, in which a model interprets command results, identifies errors, and generates revised instructions.
Under that scenario, a human attacker could set the objectives while an AI system handles repetitive command generation and troubleshooting.
However, the findings do not establish that AI was used. Bitdefender could not identify a specific model or confirm how AI tools may have contributed to the intrusion.
The distinction matters because the same attack techniques, including credential theft, privilege escalation, and lateral movement, can also be carried out without AI assistance.
AI-driven cyberattacks present a two-sided challenge for defenders
Previously, organizations had to find and patch vulnerabilities before attackers could exploit them. AI is making that race harder by helping attackers discover weaknesses, develop exploits, and adapt their operations faster. Defenders must now contend with both a shrinking window to fix vulnerabilities and attackers who can use AI to make established intrusion techniques more efficient.
For defenders, keeping pace requires more than installing security updates. They should prioritize patching internet-facing and actively exploited systems, enforce multifactor authentication, and restrict administrator privileges.
Permission abuse remains one of the ways attackers have consistently used to expand access into an organization. As such, defenders should apply the principle of least privilege to every account, ensuring employees and service accounts have only the access required for their roles.
Administrator accounts are always high risk; therefore, organizations must review them regularly, remove unnecessary permissions, and monitor privilege escalation to limit how far attackers move after an initial compromise.
AI can also strengthen the defensive side of this equation. Organizations can use AI-assisted security tools to identify vulnerabilities, prioritize remediation, and investigate suspicious activity faster.
The lesson is not that AI has transformed ransomware overnight. It is that established weaknesses in identity management, network access, and recovery planning can still allow attackers to cause substantial damage, with or without AI assistance.
In other cybersecurity news, financial technology provider Abrigo restored most of its Sageworks lending platform after shutting it down over suspicious activity, although borrower-facing services remained unavailable and the company has not confirmed a cyberattack or data breach.