A 3AM ransomware affiliate targeted school facilities in the United Kingdom, encrypting approximately 37 of the roughly 50 machines it accessed from unmanaged hosts. Researchers at Bitdefender believe the operation may have involved AI-generated commands and automated agent loops, although they could not confirm which AI model, if any, was used.
Bitdefender identifies possible AI-assisted activity
The suspected attack activity was recorded from September 10 to September 19. Bitdefender could not determine how the attackers initially gained access to the environment, but researchers observed repeated commands being issued at intervals of approximately 40 to 100 seconds. The timing varied slightly between attempts, a pattern the researchers said resembled an automated agent loop.
“Since we didn’t have access to the machine the attacker was using, we can’t document anything about the language model itself, what model it was, whether it was run locally or remotely, or even if someone was copying and pasting instructions and results between the implant and the model,” Bitdefender explains.
The researchers were therefore able to document the behavior of the attack, but not establish whether an AI system directly controlled the activity or assisted an operator.
Source: Bitdefender
Attackers targeted credentials and Active Directory
The attackers used modified versions of publicly available PowerShell tools to extract and decrypt credentials stored on three Veeam backup servers. They also copied the Chrome database containing credentials and deployed Mimikatz and LSASS memory-dumping tools.
After mapping domain relationships, the attackers searched logon script folders for references to other schools. They ultimately created two backdoor domain administrator accounts named “library” and “svc_bkpmon.”
The attackers stole financial data from compromised machines and expanded their access by configuring two-way trusts between three previously separate Active Directory domains.
In the final stage, the operation attempted to remove Sophos and Bitdefender security protections from reachable hosts, delete system state backups and deploy 3AM’s Rust-based encryption program. Approximately 37 encryption attempts were successful.
Source: Bitdefender
3AM ransomware background
The 3AM ransomware threat emerged in 2023 and gained public attention after attackers deployed its Rust-based ransomware following the disruption of LockBit.
Researchers have since linked the operation to the Conti and Royal ransomware gangs. Affiliates have been observed accessing corporate networks through email bombing campaigns and spoofed IT support phone calls.
One notable previous victim was Kootenai Healthcare, where an attack in August 2024 exposed the personal information of more than 464,000 patients.
AI-powered ransomware concerns
Regardless of how extensively AI tools were involved in this 3AM operation, Bitdefender’s observations suggest that threat actors are experimenting with AI-assisted techniques with increasing frequency.
Earlier today, the UK’s NCSC released this year’s State of the Cyber Nation report, calling on critical infrastructure organizations to prepare for AI-powered ransomware attacks by 2028.
Source: www.bleepingcomputer.com