A ransomware attack on multiple UK schools paired a human operator with an AI agent, the first documented case of its kind in Europe, according to a Bitdefender report published Tuesday.
Bitdefender reported in a its research blog, an affiliate of the 3AM ransomware operation hit a group of UK schools whose networks spanned 47 systems across several separate domains, eventually encrypting about 37 machines.
Some of the activity showed a human at the keyboard. Other parts behaved like an AI agent, with the agents running commands, reading results and repeatedly trying again with different attack methodology until the steps worked.
“It is the first case of this kind we have investigated, a hybrid operation in which some parts show a human operator at the keyboard while others behave like an agentic loop, a language model reading each result and retrying with different commands,” according to a Bitdefender research blog outlining the attacks.
After getting inside one school’s network, the 3AM affiliate used built-in Windows tools to set up trust links between domains, giving it a path into the other schools, researchers wrote.
Bitdefender is careful about what it can prove. The company says it can document the attacker’s behavior but not what produced it. It doesn’t know which AI model was involved, and it can’t rule out a person copying commands between a terminal and a chatbot. It calls the hybrid reading a working model for defenders to plan around, not an established fact.
What Happened at 3AM
3AM is not new. It first drew public notice in September 2023, when Symantec saw an affiliate switch to it after a LockBit deployment was blocked. The ransomware is written in Rust. It tries to shut down security and backup services before encrypting files, and it marks encrypted files with a “.threeamtime” extension.
3AM runs as ransomware-as-a-service. The core group builds the encryptor and leases it to affiliates, who carry out the break-ins and share the proceeds, Bitdefender says. The group typically uses double extortion, stealing data and threatening to leak it if victims don’t pay, according to a Blackpoint Cyber threat profile.
In the schools case, researchers could not determine how the attacker first got in. Every move they observed came from a single internal machine that had no security agent installed.
From there, the affiliate ran a familiar playbook:
- It pulled stored passwords from three Veeam backup servers using a modified public tool, then ran Mimikatz, renamed to look like a monitoring program.
- It searched the schools’ shared logon-script folders for the names of other schools.
- It created two backdoor domain administrator accounts, named “library” and “svc_bkpmon” to blend into a school’s account list.
After getting inside, the affiliate used built-in Windows tools to link three of the schools’ separate domains with two-way trusts, opening a path into the other schools, researchers wrote. It then zipped 40 files from a finance share and sent them out.
On Sept. 19 the attacker tried to strip Sophos and Bitdefender security tools from the network. Anti-tampering controls blocked the attempt. The 3AM encryptor still ran across about 37 machines in under half an hour and deleted Windows backups as it went. All pretty standard operating procedure for this sort of operation.
Fast Hands, Slow Decisions
What stood out to researchers, however, was how the attacker behaved and the timing recorded in the attack logs.
The attack was not fast. When a command failed, the next attempt came 40 to 101 seconds later, whether the fix was a one-word tweak or a complete rewrite. Moving on to a new task took 2 to 16 minutes, which matches the pace of someone reading output and deciding what to do next. To Bitdefender, the split suggests a person choosing the next step while a model handled the retries.
“What is different is how the attacker behaved, and several things point to an agentic loop, a program that feeds each result back to a model and runs what comes back,” Bitdefender’s researchers said.
In one sequence on Sept. 13, the attacker ran a PowerShell command and then re-ran it unchanged 41 seconds later. Forty-nine seconds after that, it changed a single line. After another 47 seconds, it abandoned PowerShell entirely for an older Windows tool.
Bitdefender says the commands themselves strongly suggest an AI model wrote them, as opposed to a human typing them out. The clearest clue is a mistake. One command tried to pull passwords from the Veeam backup software through port 9392 using a basic username and password. Veeam’s documentation uses port 9419 and requires a security token. The researchers say a model producing the command from what it had absorbed in training, rather than from the manual, would get the general shape right and the specifics wrong. Whether the attempt worked is unknown.
Other clues bolster Bitdefender’s human-AI hypothesis. Unix-style syntax kept showing up in Windows commands, a habit the researchers say fits a writer whose default is Unix, not Windows. The attacker also tested and labeled nearly every step. It left behind confirmation files such as “da_proof.txt” and a scheduled task named “VEEAMPROBE,” and it tagged its own output with labels like “===TRUSTS===” so whoever, or whatever, read it next could parse it easily. Numbered versions of the same script piled up: av_remove, then av_remove2, then av_remove3. Each was saved as a new file rather than an edit to the old one, which Bitdefender says is typical of an agentic loop writing a fresh file each round.
Those clues speak to who wrote the commands, not who ran them. Bitdefender says nothing in them shows whether software or a person fed each result back to the model, however.
Four Days From Data Theft to Lockdown (Sept. 15 to Sept. 19)
Almost everything the attacker used was already on the schools’ machines, a tactic known as living off the land. Instead of bringing in custom malware, it worked through tools that ship with Windows, including PowerShell, Windows Management Instrumentation (WMI), the registry editor and Windows’ own domain and scheduling utilities. The only exceptions were a few public hacking tools and the 3AM encryptor itself. Bitdefender found living-off-the-land tools in 84% of the high-severity attacks it analyzed in an earlier study of about 700,000 incidents.
On Sept. 15, the attacker went after the money files. It pulled 40 documents from a finance share and hid them in the Windows registry, a database Windows uses to store settings, not documents. It then zipped them and uploaded them to the unmanaged machine it was working from. Bitdefender calls that registry trick unusual and a strong clue for defenders to hunt for.
Three days later, the attacker connected the schools. The schools’ networks had been set up as separate domains, so an account in one couldn’t log in to another. In about three hours on Sept. 18, the attacker used two built-in Windows administration tools, netdom and dnscmd, to set up two-way trusts between three of those domains, researchers wrote. Once the domains trusted each other, an account from one could log in to the others. The attacker then pushed access for its backdoor account to about 40 machines.
The next morning, Sept. 19, the attacker ran scripts to remove the Sophos and Bitdefender security software on the network. Anti-tampering controls stopped the removal, but that didn’t save the machines. Starting just after 5 a.m. UTC, the 3AM encryptor took about 12 seconds per machine and hit roughly 37 machines in 26 minutes. It deleted Windows system backups along the way, so the schools couldn’t simply roll back. All pretty standard operating procedure for this sort of operation.
The Human Stays in the Loop
The 3AM case adds to a pattern SPB has been tracking all year. Attackers aren’t turning AI loose. They’re pointing it at targets and letting it do the labor.
Two weeks ago, Wiz incident responders said an AI agent ran a multi-cloud intrusion end to end. Human operators aimed it, and the agent did the work, running hundreds to thousands of actions an hour with no breaks. SPB traced the ARTEX AI pen-testing agent through South Korea’s 66,000-victim bank hacks. It also reported on an OpenAI research agent slipping past Services Australia’s Medicare blocks. North Korea’s Lazarus Group has been using AI to build fake job-candidate lures before hand-tailoring them to targets. In each case, a person picked the target and the AI did the grunt work.
What sets the 3AM case apart is the pace. The Wiz agent moved at machine speed. This one did not. Bitdefender pointedly calls “machine speed” a marketing phrase, usually attached to expensive incidents backed by frontier-scale AI. It expects real-world attacks, especially those running smaller local models, to look more like this one. A model grinding through retries every minute or so while a human decides what comes next, is different.
Despite massive advances, there remain points of weakness where AI still falls short of human operators (such as writing news articles) and an actual meatbag is the better option. A hybrid approach shores up those weak points. The human supplies judgment, and the model supplies the patience for fiddly work like wiring domains together.
That’s also why Bitdefender expects hybrid attacks like this to become more common in 2027. The approach is cheap, and it needs no skills these attackers don’t already have.
It isn’t a trend yet, the company stresses. Most intrusions it investigates still look the way they did before language models, and AI-written “vibeware” makes up about 0.07% of the malware samples Bitdefender collects each month.
The approach also has a weakness defenders can use. They are noisy. A loop that keeps retrying leaves a trail of repeated commands, numbered scripts and probe files. “A loop does not make an intrusion quiet or subtle,” the researchers wrote.
Bitdefender’s advice is to block attacks rather than try to outrun them. Alert on any new trust between domains, a rare change on a healthy network. Treat backup servers as targets, not just safety nets. Keep administrator credentials for separate domains apart. Put a security agent on every machine, including the kind of unmanaged box this attacker worked from.
