Threat Intelligence

Ransomware Affiliate May Have Used AI to Write Attack Commands in European School Breach

Dark Reading · 4 Nov 2026

Key Takeaway Keep strengthening the basics, such as multi-factor authentication, prompt patching, tested offline backups and monitoring for unusual activity, because these defences work whether an attacker's commands are written by a person or an AI.

Researchers examining an attack on a school in Europe have found evidence that an affiliate of the 3AM ransomware gang may have used an AI model during the breach. The evidence suggests the model generated and revised commands as the intrusion unfolded.

The researchers were careful about how far they took this finding. They stopped short of claiming the attack was fully automated, so it is not clear how much of the operation was driven by AI and how much was still directed by a human operator.

The case is a reminder that criminals are experimenting with AI tools to support their work. The source summary does not detail the specific techniques involved, so the wider impact remains to be seen. For businesses, the practical point is that the fundamentals of defence still apply, because the attackers' goals and the damage ransomware can cause have not changed.

ransomware 3AM AI education threat intelligence

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.