# UK school estate hit by 3AM ransomware in suspected AI-assisted attack

DevFeed: [UK school estate hit by 3AM ransomware in suspected AI-assisted attack](<https://devfeed.tech/articles/uk-school-estate-hit-by-3am-ransomware-in-suspected-ai-assisted-attack-114231.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/uk-school-estate-hit-by-3am-ransomware-in-suspected-ai-assisted-attack/>)

Author: Bill Toulas

Published: 2026-11-03T14:00:00Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>)

Tags: [3am-ransomware](<https://devfeed.tech/tags/3am-ransomware.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [ai-assisted](<https://devfeed.tech/tags/ai-assisted.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [attack](<https://devfeed.tech/tags/attack.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [education](<https://devfeed.tech/tags/education.md>), [encrypted](<https://devfeed.tech/tags/encrypted.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [infosec-computer-security](<https://devfeed.tech/tags/infosec-computer-security.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [machines](<https://devfeed.tech/tags/machines.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [school](<https://devfeed.tech/tags/school.md>), [security](<https://devfeed.tech/tags/security.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [uk](<https://devfeed.tech/tags/uk.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

A 3AM ransomware affiliate encrypted about 37 of nearly 50 machines it reached at a UK school estate. Bitdefender suspects AI-generated commands or an automated agentic loop because commands were repeated with slight changes at intervals of roughly 40-100 seconds. The researchers could not access the attacker's machine, so they could not establish whether an AI model was involved or how it was used; they also could not determine initial access. The attacker harvested credentials from Veeam servers and Chrome, used Mimikatz and LSASS dumping tools, created two backdoor domain administrator accounts, stole financial data, and linked three Active Directory domains with two-way trusts. It then tried to disable security tools, delete system-state backups, and deploy 3AM's Rust encryptor.

## Source excerpt

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]