3AM Ransomware AI Attack: A UK School Estate Lost About 37 Machines to One Unmanaged Host, and What to Check This Week

A criminal affiliate of the 3AM ransomware operation got into a UK school estate in September 2026. It worked from one unmonitored computer for nine days and encrypted about 37 of the roughly 50 machines it reached. The firm that investigated believes an AI model wrote many of the attacker's commands. The bigger warning for any business is how ordinary the gaps were: an unmanaged machine, backup servers holding admin passwords, and Windows PCs that no longer get security fixes.

What happened in the 3AM ransomware attack

Bitdefender published its investigation on Tuesday, November 3, 2026. It describes the victim only as a UK school estate, a "mid-sized public-sector target" that started out as several separate Active Directory domains. Active Directory is the Windows system that controls who can log in to what across a network. The machine list Bitdefender worked from held 47 systems. These included about 21 servers (8 of them domain controllers), 10 workstations still on Windows 10 and one domain controller on Windows Server 2012 R2.

Every attacker action Bitdefender saw came from one internal machine that had no Bitdefender agent on it. How the attacker first got in has not been established. Here is the confirmed timeline, with times in UTC:

• Thursday, September 10 to Friday, September 11: a modified copy of a public PowerShell script read and decrypted stored credentials from the databases of three Veeam backup servers. Saved Chrome logins were copied from a terminal server.
• September 12 to 14: the attacker checked who was in the Domain Admins and Enterprise Admins groups. They downloaded Mimikatz, a well-known password-dumping tool, renamed as sysmon64.exe, tried to dump passwords from memory, and created a backdoor domain admin account named "library".
• September 15: a second domain admin account, "svc_bkpmon", was created. Data from a finance share was gathered and sent out.
• Friday, September 18, afternoon: the attacker set up two-way trusts between three domains that had been separate, then pushed a script to about 40 machines.
• Saturday, September 19, 05:07 to 05:33: scripts tried to remove Sophos and Bitdefender protection. Anti-tampering controls blocked the removal. System-state backups were deleted and the 3AM encryptor ran. About 37 machines were encrypted.

Bitdefender says the account names were picked to blend in with a school's account list. The pattern is worth noticing: quiet credential theft during the week, a big change on Friday afternoon, and encryption early on Saturday morning.

Was this really an AI ransomware attack?

Bitdefender is careful on this point. Its report grades three separate claims:

The evidence for AI:

• Retries came 40 to 101 seconds apart, no matter how big the change was.
• Windows commands contained Linux habits such as 2>/dev/null.
• A Veeam API call used port 9392 and Basic authentication. Bitdefender says Veeam's documented examples use port 9419 and token logins, which is the kind of mistake a model recalling from memory makes.
• Outputs were labelled with test strings such as "test123" and "TASK-OK", and scripts were numbered as revisions.

The evidence against a fully autonomous attack: the encryptor was a standard 3AM build, all the tools were public, the payloads contained no reasoning text, and no decision cycle ran faster than about 40 to 60 seconds. Bitdefender calls the attack neither fast nor innovative.

What is not known: how the attacker got in, which AI model was used, which schools or how many people are affected, exactly what was in the stolen finance data, and whether a ransom was demanded or paid. Bitdefender could not access the unmanaged machine, so it cannot see the attacker's side.

Why this matters for a company network

None of the techniques in this attack were new. If AI helped, it most likely helped with persistence: retrying failed commands, slightly changed each time, until they worked. That makes this kind of intrusion easier for more people to run, so the defences that matter are the basic ones.

• One unmanaged machine was enough. Your security tools cannot stop what they cannot see. Every device on the network needs an agent, or it needs to come off the network.
• Backups were the key ring. Backup servers often hold the passwords for everything they back up. In this attack they were the first stop, and deleting backups was the last step.
• Separation was undone in an afternoon. The attacker already had domain admin rights, so joining the separate domains took only a few commands. Separate networks only help if the admin accounts are separate too.
• Old Windows stayed on the network. Microsoft ended Windows 10 support on October 14, 2025. It no longer provides security fixes for Windows 10 unless a device is enrolled in Extended Security Updates. If you are not sure who owns patching at your company, read Who Is Patching the Software That Runs Your Business?

The same risks apply to any business with more than one site, a Windows domain and a backup server. That includes medical practices, manufacturers, law firms, property managers and multi-location retailers.

What to check this week

Bitdefender has also published indicators of compromise for this case, in the file 2026_11-3am-iocs.csv in its malware-ioc repository on GitHub. Your security provider can use them to search your network. CISA's ransomware guide makes the same core points. Keep offline, encrypted backups and test them, because "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups." Use network segmentation to limit how far an intruder can spread.

3AM ransomware questions people are asking

What is 3AM ransomware?

3AM, also written ThreeAM, is a ransomware-as-a-service operation: affiliates rent the malware and run their own attacks. Public tracking cited by Bitdefender lists it as first seen in February 2023. The encryptor in this case is written in Rust.

Did AI run the attack by itself?

That is not proven. Bitdefender says a language model very likely wrote the commands, but it cannot rule out a person pasting them in by hand. It rates the claim that no human was involved as unsupported.

How did the attackers get in?

Nobody knows. Bitdefender says the way in was not established.

Which UK schools were hit?

The schools have not been named. Bitdefender describes the victim only as a UK school estate.

Is Veeam vulnerable?

Bitdefender's report does not describe a flaw in Veeam's software. The attacker already had access to the backup servers and used a public script to read the credentials Veeam had stored. The fix is isolating the servers and using separate accounts, not a patch.

Are AI ransomware attacks faster?

Not in this case. Bitdefender says the attack was neither fast nor innovative.

Would antivirus have stopped it?

Partly. Anti-tampering blocked the attempts to remove Sophos and Bitdefender, but the attacker worked from a machine with no agent at all. Gaps in coverage matter as much as the product you choose.

The bigger lesson

AI did not create new weaknesses here. It may have helped an attacker keep pushing on old ones until something gave way. The networks that hold up are the ones where every device is visible, backups cannot be reached with everyday admin passwords, and a change like a new domain trust sets off an alarm. To see how attackers can go from one foothold to full Active Directory control another way, read Microsoft Teams Phishing: Fake IT Support Calls Led to AD CS Certificate Abuse.

Want a second set of eyes on your network? See security hardening or get a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: Bitdefender: 3AM Hits European Schools, A Hybrid AI Ransomware Attack; Microsoft: Windows 10 end of support; CISA: Ransomware Guide.