AI‑Assisted 3AM Ransomware Encrypts 37 Machines in a UK School Estate

O que aconteceu

In September 2024, a 3AM ransomware affiliate compromised a UK school estate, encrypting 37 of ~50 reachable machines. Bitdefender observed AI‑generated PowerShell commands issued at regular intervals, suggesting an automated agentic loop. Attackers extracted credentials from Veeam backup servers, stole a Chrome database, deployed Mimikatz and LSASS dumping tools, and created two back‑door domain‑admin accounts. They forged two‑way trusts across three AD domains, stole financial data, disabled endpoint protections, deleted system‑state backups, and deployed the Rust‑based 3AM encryptor. Initial access method was not identified.

Por que isso importa para confiança e conformidade

• The incident demonstrates the need for robust credential protection and privileged‑account monitoring—key control objectives that support incident‑response assurance across multiple frameworks.
• Validate privileged‑account management and MFA enforcement to satisfy incident‑response control requirements.
• Implement continuous monitoring of PowerShell and credential‑dumping activity to collect defensible evidence for audit readiness.

Who is affected

Recommended actions

1. Enforce MFA and least‑privilege for all domain‑admin accounts.
2. Deploy real‑time monitoring of PowerShell and credential‑dumping tools; set alerts for anomalous command patterns.
3. Adopt immutable, offline backup solutions and verify restore capability regularly.
4. Run tabletop exercises that include AI‑assisted ransomware scenarios.