3AM Affiliate Embraces AI-Like Loops in European School Attack
Evidence suggests a model may have generated and revised commands during the ransom gang’s breach, though researchers stopped short of claiming full automation.
Evidence suggests a model may have generated and revised commands during the ransom gang’s breach, though researchers stopped short of claiming full automation.
A 3AM ransomware attack targeting a UK school estate may provide an early look at how cybercriminals could use AI as a force multiplier rather than a replacement for human operators.
Bitdefender today published research concerning a “hybrid AI ransomware attack” observed in the wild, attributing certain actions taken to human or agentic elements. On the surface, the attack is fairly straightforward. As a blog post explained, a 3AM ransomware affiliate attacked a school in the UK, “then used ordinary Windows tools to build domain trusts and reach other schools.”
Attackers stole backup credentials, created rogue domain-admin accounts, established trusts between previously separate Active Directory domains, moved between schools, stole data, and deployed 3AM ransomware. In other words, the attack largely followed a familiar ransomware playbook, despite Bitdefender’s claims that AI helped execute parts of the operation.
Where the attack got more interesting was how, as the security vendor argued, it didn’t fit neatly into pre-existing buckets for attacks involving AI. It wasn’t exactly an AI-generated attack where the malware was fully or largely created by a large language model (LLM); it wasn’t exactly an AI-assisted attack where human engineers built the tools while using AI to speed up work; and it wasn’t exactly an AI-operated attack where the LLM orchestrates actions and runs the show, as it were.
In this case, Bitdefender argued an AI system appeared to handle repetitive command generation and troubleshooting while a human operator made high level decisions.
Cyberattacker Profile: Part Human, Part Agent?
Many elements of the attack were ordinary for ransomware, such as significant use of living-off-the-land (LOTL) techniques, where attackers abuse tools already present on the victim’s machine rather than relying on malware — in this case PowerShell, Windows Management Instrumentation (WMI), reg, netsh, rundll32, and other domain and scheduling utilities preinstalled on Windows. The attacker also used “an Impacket-style remote-execution tool,” as well as Mimikatz and a previously published Veeam script.
But despite the attack’s ordinary nature, Bitdefender assessed that several things suggest the use of an agentic loop, the control structure that makes an AI agent work. Certain actions appeared to be taken by a program rather than a human operator.
“The commands carry the usual tells of a model: a call to the backup software’s web interface (Veeam, a widely used enterprise backup product) on a port and with a login method that do not match the vendor’s documentation, a mistake typical of writing from memory rather than from the manual (Veeam REST API authorization), along with confirmation files, self-labeled output and numbered revisions of the same script,” the blog post read. “The retries behave like a loop too.”
In another example, researchers assessed that the time taken between PowerShell command attempts was shorter than a human would take if issuing them by hand, but longer than if an LLM was orchestrating by itself. The longer time taken between individual tasks but the shorter time between retries “is what it looks like if a person is choosing the next step and a model is handling the retries.”
Bitdefender caveated its findings by noting that it was unable to access the machine the attacker worked from, so it couldn’t document anything tangible involving the AI model itself. The research acts as an argument that this attack behaves like a human operating alongside an agent, which is a working model defenders may wish to plan around.
With that in mind, Martin Zugec, technical solutions director at Bitdefender, tells Dark Reading that “a hybrid model is more reasonable for financially motivated cybercriminals, technically and economically, than a fully autonomous attack.”
Not Just Another Ransomware Attack
But even as a one off, the situation is notable because the primary victim was an organization in a critical sector, and Bitdefender’s anecdote suggests the affiliate may have used an AI agent to scale the attack by handling repetitive troubleshooting and command generation, although the report stops short of showing AI-enabled capabilities the attacker otherwise lacked.
Moreover, other similar institutions could fall in the crosshairs. “From a domain controller it enumerated trust relationships between domains and searched SYSVOL (the shared folder where Active Directory stores logon scripts, readable by any domain user) for the names and subnets of other schools,” according to the research blog post.
The good news is that because much of this attack followed the typical ransomware playbook, the defender recommendations that stop regular ransomware would also stop the attack described in this research.
Zugec adds that agentic loops are noisy from an indicator standpoint, as many of their actions are repetitive and brute force in nature. “An agentic loop doesn’t make an attack quiet, it makes it repetitive: the same command re-run, small tweaks, numbered scripts and probe files left on disk. Even the quickest retries took 40 seconds or more. ‘Machine speed’ is mostly a marketing phrase about very expensive incidents; in real attacks, especially with local models, we expect this slower and noisier pattern. Speed isn’t the giveaway, repetition is.”
The vendor recommends focusing on prevention: Keep admin credentials of different domains separate, treat backups as a possible target, restrict remote execution and administrative shares to known management hosts, block interpreters and shells on machines that never use them, and put endpoint security tooling on every machine.
“Prefer controls that work regardless of volume and speed,” the blog post read, “because they stop an action the first time and the hundredth.”
Read more about:
