An incident involving ransomware against a UK school network has brought attention to how much of a factor AI is becoming in cybercrime. During the attack, an affiliate running 3AM ransomware utilised an unmanaged host to gain access to nearly half of the machines (encrypting approximately 37).
This was discovered by Bitdefender.
There were multiple indications during the investigation into the attack that AI could have been involved. There were multiple instances where the attacker was running similar commands with slight modifications between each run. These commands had approximately 40-100 second gaps between them. This could be seen as an automated agent, whereby the system would create commands, assess the outcome and adapt the next command.
Bitdefender cannot confirm there was any involvement from a language model. As the machine the attacker was using could not be looked at by researchers, there is no way to confirm what model was used, or if it was local or remote. This is a purely an observation.
The attack occurred between 10th and 19th of September. The initial method of gaining access is unknown. The attacker focused on gaining credentials and expanding their access. They used a modified public PowerShell tool to extract and decrypt credentials from 3 Veeam backup servers. They also extracted a Chrome database containing saved login information.
Mimikatz and LSASS memory extraction tools were also deployed.
The attacker also carried out further reconnaissance. They looked at domain relationships and searched login script folders to find any mention of other schools. They created 2 domain admin accounts called ‘library’ and ‘svc_bkpmon’ to give themselves persistence.
Financial data was also extracted from the compromised machines. The attacker then created 2 way trust relationships between 3 previously separate Active Directory domains.
Finally they attempted to disable endpoint protection. Sophos and Bitdefender were targeted for removal. System state backups were also targeted for removal. The affiliate then deployed the Rust based encryption tool from 3AM, impacting around 37 machines.
3AM first came to light in 2023 after being used by an attacker when LockBit was blocked. It has been linked to Conti and Royal ransomware gangs.
The affiliates have been linked to Email Bombing and pretending to be IT support via spoofed calls.
This group has previously been linked to major data leaks. Kootenai Health revealed an incident in August 2024 where personal data from over 464,000 patients was compromised.
This investigation by Bitdefender shows there is concern around ransomware actors experimenting with AI assisted methods.
Whilst it is unclear exactly how much AI was involved in this incident, this comes at a key time as the National Cyber Security Centre in the UK has released their annual ‘The State of the Cyber Nation’ report. They are urging organisations in critical infrastructure to be prepared for AI driven ransomware threats by 2028.
Read the original article:
UK School Network Hit by 3AM Ransomware as Researchers Suspect AI-Assisted Intrusion