Ransomware Gang Mixes Human Skill and AI Automation in Attack on UK School Estate

A UK school estate was compromised by an affiliate of the 3AM ransomware group in an attack that mixed human and AI activity, according to an investigation by Bitdefender. The incident ran from September 10 to 19, 2026. Attackers encrypted 37 machines and built domain trust in the compromised estate so they could reach other schools. Bitdefender called it the first case of this kind it has documented in Europe. 3AM is a ransomware-as-a-service operation, and its Rust-based encryptor was first seen in February 2023.

The researchers could not determine how the attackers first got in. The earliest recorded activity was on September 10, when they accessed credentials stored in the estate's backup infrastructure and decrypted them using the Windows Data Protection API. On September 12 and 13, they used stolen administrator credentials to send commands through Windows Management Instrumentation (WMI) to test connections to other hosts. The outputs were read by either a person or an AI model, which then chose the next command. Timing gave the AI away: a complete rewrite of a command arrived as quickly as a minor tweak, with delays of 40 to 101 seconds regardless of the size of the change.

Bitdefender assessed that the hybrid approach makes economic sense for attackers, with a person setting goals and an AI model handling the mechanical work. It expects hybrid attacks like this to become more common in 2027.