A ransomware affiliate spent nine days inside an unnamed UK school estate in September, stealing finance data and encrypting about 37 machines — and parts of the hands-on work appear to have been carried out by an AI model. Bitdefender published its investigation on 3 November 2026, attributing the intrusion, with confidence, to an affiliate of 3AM, also written ThreeAM.

How the intrusion unfolded

The attack ran from 10 to 19 September. The estate held 47 systems, including around 21 servers, eight of them domain controllers, ten Windows 10 workstations that have been out of support since October 2025, and one domain controller still running Windows Server 2012 R2. The attacker first stole stored credentials from Veeam backup databases, copied a Chrome saved-password file from a terminal server, and downloaded the credential-theft tool Mimikatz. On 15 September, forty finance files were staged, zipped and uploaded to the attacker's command-and-control page.

Domain trusts bridged the schools

On 18 September the attacker linked three separate Active Directory domains with two-way trusts in about three hours, pushing a backdoor account's access across the estate. The 3AM encryptor then ran on the morning of 19 September, between 05:07 and 05:33 UTC, deleting system-state backups as it went. Attempts to remove Sophos and Bitdefender protections were blocked by anti-tampering controls. Bitdefender could not establish how the attacker first got in, and as of 3 November no leak-site listing tied to the attack had surfaced.

The AI question

Bitdefender describes the operation as a hybrid: a human apparently choosing objectives, with something behaving like an agentic loop — software handing each result back to a model that retries with changed commands — handling the repetitive work. The company is explicit about the limits: it never saw the machine the attacker worked from, an unmanaged host with no security agent, so it cannot name the model, say where it ran, or rule out a person pasting output into a chatbot. It calls the case "the first case of this kind that we have documented in Europe" and "one case, an anecdote, and not a trend", while expecting hybrid attacks to become more common in 2027.