3AM Ransomware Gang Deploys Hybrid AI Attack Against Schools
A ransomware affiliate used living-off-the-land techniques and an automated agentic loop to breach a European educational network.
- By Jesse Jacobs
- November 05, 2026
A cyberattack against a school estate in the United Kingdom revealed a hybrid model that combined human operators with automated language models, according to findings released by Bitdefender.
The intrusion compromised approximately 47 systems across multiple schools. The operation was attributed to an affiliate of the 3AM ransomware syndicate.
Investigators identified evidence of a division of labor between human decision-making and automated execution, as reported by the research team. Tasks showed gaps of two to 16 minutes between operational phases, while failed commands triggered rapid retries spaced 40 to 101 seconds apart regardless of script complexity. Bitdefender explained that this fixed cadence indicates an agentic loop, in which a model ingests command output, alters syntax and executes the next attempt.
The commands contained syntax errors characteristic of language models writing from memory rather than technical documentation. These included incorrect ports for enterprise backup interfaces, missing delimiter parameters in administrative queries and Unix escape characters within Windows PowerShell scripts.
The attackers used native Windows administration tools rather than custom intrusion software, according to the analysis. The operation deployed PowerShell, Windows Management Instrumentation, netsh, reg and rundll32.
The affiliate extracted stored credentials from backup servers to create backdoor domain administrator accounts, as reported by the researchers. The attacker then used native tools including netdom and dnscmd to build two-way administrative trusts between previously isolated school domains.
After establishing cross-domain access, the affiliate attempted to disable endpoint security software and deployed the 3AM file encryptor across roughly 37 machines, the publication explained. The encryptor executed at 12 to 13 seconds per endpoint while deleting system-state backups using wbadmin.