Observed incident

3AM affiliate encrypts about 37 machines across a UK school estate

Reported

Published here

What happened

A 3AM ransomware affiliate stole backup credentials and created administrator accounts and domain trusts. About 37 machines were encrypted. Bitdefender inferred AI assistance from command errors and repeated retries.

Parties and reporting

AI tools and systems: 3AM ransomware, Suspected language model or agent loop, Active Directory, Veeam

Outcome

Bitdefender reconstructed cross-domain activity and the September 19 encryption. It lacked the operator’s machine and could not distinguish an automated loop from a person pasting commands. Recovery and ransom payment were not reported.

Operating lesson

Scope backup credentials to each domain, alert on new domain trusts and test recovery copies that domain administrators cannot delete.

Evidence and limits

November 3 is the report date. The intrusion occurred in September. The researchers attribute the ransomware to a 3AM affiliate. AI use is an inference from endpoint evidence, and no model was identified.

Sources