603/69 Wednesday, November 4, 2026
Bitdefender has disclosed a cyberattack against the IT network of a school organization in the United Kingdom, where attackers associated with the 3AM ransomware group gained access to nearly 50 computers through an unmanaged host and successfully encrypted approximately 37 systems. The malicious activity was observed between September 10 and 19, 2026. Researchers noted that the attackers may have used Artificial Intelligence (AI) to generate commands and support the operation in an agentic loop, as multiple commands were repeatedly issued with minor variations at intervals of approximately 40 to 100 seconds. However, Bitdefender stated that it could not confirm whether AI was actually used because researchers did not have access to the attackers’ originating systems and therefore could not determine which AI model or workflow may have been involved.
Analysis of the attack showed that the attackers used a PowerShell tool modified from publicly available code to extract and decrypt credentials stored on three Veeam Backup servers. They also copied Chrome databases containing credentials and used Mimikatz and LSASS memory dumping to collect additional authentication data. The attackers then conducted reconnaissance of domain relationships and searched Logon Script folders linked to other schools before creating two Domain Administrator accounts, named library and svc_bkpmon, to maintain backdoor access. In addition, they stole financial information from compromised systems and established two-way trust relationships between three Active Directory domains that had previously been separated, allowing them to expand access across the internal network.
In the final stage, the attackers attempted to uninstall Sophos and Bitdefender security software from accessible systems and delete system-state backups before deploying 3AM ransomware, a Rust-based file-encrypting malware. Approximately 37 systems were successfully encrypted. The 3AM ransomware group first emerged in 2023 and has previously been reported as having links to the Conti and Royal ransomware ecosystems. The group has also used techniques such as email bombing and phone calls impersonating IT support personnel to gain access to corporate networks. Bitdefender stated that the attack pattern suggests threat actors may be experimenting with AI to support more stages of cyber operations, while the United Kingdom’s National Cyber Security Centre (NCSC) has warned critical infrastructure organizations to prepare for increasingly AI-enabled ransomware attacks by 2028.