INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

3AM Ransomware Hits 37 UK School Systems via AI-Assisted Attack

| 2026-11-03 16:10 HIGH LOW AI-ENABLED ATTACK · AUTONOMOUS RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
In research shared with Hackread.com ahead of its publication, the cybersecurity firm detailed how a 3AM (ThreeAM) ransomware affiliate breached a UK school estate with 47 systems across separate Active Directory domains and encrypted about 37 machines. A 3AM ransomware attack targeting a UK school estate may provide an early look at how cybercriminals could use AI as a force multiplier rather than a replacement for human operators. A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.
Technical Observables 1 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
files 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
EUROPE EUROPE educationeducation
Incident Timeline
‎September 2026
Timeline of the school attack, from credential theft to ransomware deployment in September 2026.
tactic Ransomware
Timeline of the school attack, from credential theft to ransomware deployment in September 2026.
‎2026/11/03
Threat actors used email bombing and spoofed IT support calls, along with tools like Mimikatz and Impacket-style remote execution, to access corporate networks in a suspected AI-assisted attack on 37 UK school systems.
infrastructure Windows
As a blog post explained, a 3AM ransomware affiliate attacked a school in the UK, "then used ordinary Windows tools to build domain trusts and reach other schools.
Many elements of the attack were ordinary for ransomware , such as significant use of living-off-the-land (LOTL) techniques, where attackers abuse tools already present on the victim's machine rather than relying on malware — in this case PowerShell, Windows Management Instrumentation (WMI), reg, netsh, rundll32, and other domain and scheduling utilities preinstalled on Windows.
How the attacker used Windows services to execute commands and retrieve results.
organisation Bitdefender
Cybersecurity firm Bitdefender has investigated what it believes is Europe’s first ransomware incident involving a human operator and suspected AI-driven command retries.
In other words, the attack largely followed a familiar ransomware playbook, despite Bitdefender's claims that AI helped execute parts of the operation.
organisation Sophos
The following day, attempts to remove Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls.
In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor.
organisation School Systems
3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack.
infrastructure 37 machines
In research shared with Hackread.com ahead of its publication, the cybersecurity firm detailed how a 3AM (ThreeAM) ransomware affiliate breached a UK school estate with 47 systems across separate Active Directory domains and encrypted about 37 machines.
infrastructure 50 machines
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.
organisation LockBit
Attack timeline Source: Bitdefender The 3AM ransomware threat  emerged in 2023 and came to public attention when an attacker deployed its Rust-based ransomware after LockBit was blocked.
organisation WMI
Many elements of the attack were ordinary for ransomware , such as significant use of living-off-the-land (LOTL) techniques, where attackers abuse tools already present on the victim's machine rather than relying on malware — in this case PowerShell, Windows Management Instrumentation (WMI), reg, netsh, rundll32, and other domain and scheduling utilities preinstalled on Windows.
organisation Rust
The attacker deployed a script loader before running the Rust-based 3AM encryptor, which encrypted about 37 systems and deleted system-state backups with wbadmin.
infrastructure 40 machines
A scheduled PowerShell task then pushed the backdoor account’s access to about 40 machines.
organisation Netlogon
Netlogon was restarted later that day.
organisation Adaptive Security's
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
organisation Microsoft 365
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Google Workspace
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Bitdefender’s
Regardless of the current level of AI tool involvement in 3AM attacks, Bitdefender’s observations suggest the threat actors appear to be experimenting with them heavily.
organisation Affiliate
3AM Affiliate Embraces AI-Like Loops in European School Attack.
organisation Shield
Related: Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform
organisation Active Directory
"From a domain controller it enumerated trust relationships between domains and searched SYSVOL (the shared folder where Active Directory stores logon scripts, readable by any domain user) for the names and subnets of other schools," according to the research blog post.
Tactical Metrics
Metrics
infrastructure
37
Machines
In research shared with Hackread.com ahead of its publication, the cybersecurity firm detailed how a 3AM (ThreeAM) ransomware affiliate breached a UK school estate with 47 systems across separate Active Directory domains and encrypted about 37 machines.
Metrics
infrastructure
‎Windows
Affected Product
Domain Trusts and Ransomware Deployment The attacker stole backup credentials on September 10 and 11 using scripts that decrypted stored passwords with Windows DPAPI and copied browser credentials.
How the attacker used Windows services to execute commands and retrieve results.
The affiliate mainly used living-off-the-land techniques, relying on Windows tools such as PowerShell, WMI, netsh, reg and rundll32.
On September 15, files from a finance share were staged in Windows registry values and transferred through an unmanaged machine used as command-and-control infrastructure.
As a blog post explained, a 3AM ransomware affiliate attacked a school in the UK, "then used ordinary Windows tools to build domain trusts and reach other schools.
Many elements of the attack were ordinary for ransomware , such as significant use of living-off-the-land (LOTL) techniques, where attackers abuse tools already present on the victim's machine rather than relying on malware — in this case PowerShell, Windows Management Instrumentation (WMI), reg, netsh, rundll32, and other domain and scheduling utilities preinstalled on Windows.
Metrics
infrastructure
40
Machines
A scheduled PowerShell task then pushed the backdoor account’s access to about 40 machines.
Metrics
infrastructure
50
Machines
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.
Metrics
infrastructure
‎Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Intelligence Sources
Dark Reading 2026-11-03
BleepingComputer 2026-11-03
HackRead 2026-11-03