A ransomware intrusion against a group of schools in the United Kingdom has given security researchers an unusually clear look at what a “hybrid” human-plus-AI attack actually looks like in practice. According to findings published by Bitdefender, the affiliate behind the attack combined manual decision-making with what appears to be AI-driven automation to compromise a 47-system school network and ultimately encrypt 37 machines using the 3AM ransomware encryptor.

Who’s Behind 3AM

3AM, sometimes written as ThreeAM, operates as a ransomware-as-a-service family built in Rust. The group behind it doesn’t typically run its own intrusions; instead, it licenses the encryptor to affiliates who handle the actual break-in and share a cut of any ransom proceeds. Historically, 3AM-linked affiliates have gone after small and mid-sized organizations rather than large enterprises, and this school network fits that pattern.

Inside the School Network

The target was a sprawling but loosely connected school estate: roughly 47 systems in total, including about 21 servers (eight of them domain controllers) and ten workstations still running the long-aging Windows 10. Rather than one unified network, the environment was made up of several separate Active Directory domains that hadn’t previously been linked together — a detail that becomes important later in the intrusion. Bitdefender’s researchers were not able to determine the attackers’ initial point of entry.

What they could reconstruct was the sequence that followed. On September 10 and 11, the attackers used a modified version of a publicly available Veeam script to steal credentials from three backup servers — a reminder of just how frequently backup infrastructure ends up as a prime early target in ransomware intrusions. From there, they deployed Mimikatz (disguised under the renamed file sysmon64.exe) to harvest further credentials and created two new domain admin accounts named “library” and “svc_bkpmon,” names deliberately chosen to blend into a school’s normal account naming conventions.

The Telltale Signs of an AI Agent at Work

The clearest evidence that an AI tool was involved in the operation came from command timing patterns observed on September 13. Bitdefender documented the attacker running an identical command, repeating it unchanged 41 seconds later, tweaking a single parameter 49 seconds after that, and then switching entirely to a different tool roughly 47 seconds after that. Across the broader intrusion, retries of failed or partially successful commands consistently occurred every 40 to 101 seconds, while genuine shifts to new attack objectives took considerably longer — a cadence that fits neatly with a human operator setting high-level goals while an AI agent grinds through the repetitive retry work in between.

Several other artifacts reinforced that theory, including mistakes that read like the kind of error a language model makes when recalling syntax from memory rather than testing it directly:

• A Veeam command executed with the wrong port and authentication method
• Bash-style escape characters mistakenly used inside native Windows commands, observed across three separate days
• A trail of leftover test and probe files, including names like “psexec-ok” and “da_proof.txt”
• Numbered, iterative script versions such as av_remove.ps1, av_remove2.ps1, and av_remove3.ps1

On September 18, the attackers used Windows’ built-in netdom and dnscmd utilities to join three previously separate Active Directory domains using two-way trusts, then searched shared folders for information on other schools’ networks — exactly the kind of fiddly, trial-and-error configuration work that an AI agent, iterating against error messages, tends to handle efficiently. The following day, after failed attempts to strip security software from a file server were blocked by anti-tampering protections, the attackers launched the 3AM encryptor (host.exe) across the network between 05:07 and 05:33 UTC, encrypting machines at a rate of roughly 12 to 13 seconds each while simultaneously deleting system-state backups to complicate recovery.

Researchers Urge Caution Before Calling It a Trend

Bitdefender is careful to frame this as a single documented case rather than evidence of a broad shift in ransomware tradecraft. The toolkit used was largely off-the-shelf, the encryptor was a standard build, and none of the individual steps required novel technical skill. Even so, the firm expects hybrid human-AI intrusions of this kind to become more common through 2027, consistent with other recent cases researchers have flagged, including AI-run extortion operations and ransomware campaigns where AI coding agents handled the bulk of network-level attack work.

Importantly, the same noisy, repetitive behavior that made this automation efficient for the attackers also made the intrusion easier to detect in hindsight — frequent retries, leftover probe files, and oddly consistent timing all leave a trail. Bitdefender recommends that defenders segment admin accounts across separate domains rather than allowing cross-domain trust by default, alert on any new domain trust creation or unexpected netdom activity, protect backup infrastructure with immutable, non-deletable copies, restrict WMI, remote registry, and ADMIN$ access to dedicated management hosts, and ensure endpoint protection is deployed consistently across every machine in the environment, including older systems that are easy to overlook during routine security reviews.