3AM Ransomware Hit a UK School Estate With What Looked Like an AI Agent Loop — Rewritten Retries Every 40–100 Seconds, Veeam Credentials Stolen, 37 Machines Encrypted

High · 2026-11-05 · By H.A

3AM Ransomware Hit a UK School Estate With What Looked Like an AI Agent Loop — Rewritten Retries Every 40–100 Seconds, Veeam Credentials Stolen, 37 Machines Encrypted

Researchers say a 3AM affiliate who encrypted about 37 of nearly 50 machines across three trusted school domains issued slightly rewritten retries at agent-like intervals, stole Veeam backup credentials and created backdoor admins 'library' and 'svc_bkpmon'.

Overview

Security researchers have published a report on a 3AM ransomware intrusion against a UK school estate between 10 and 19 September 2026. The operator reached nearly 50 machines, encrypted about 37 of them, stole financial data and destroyed backups. What makes the case unusual is how the attacker worked. The command stream looked less like a person typing and more like an agentic loop: failed commands came back slightly rewritten, and new ones arrived at fairly regular intervals of about 40 to 100 seconds.

The researchers say plainly that they cannot prove an AI model was involved. They never got access to the attacker's machine, so they cannot say which model was used, whether it ran locally or as a service, or whether a person was just copying output between an implant and a chatbot. In their view a human chose the goals and an automated agent handled the repetitive work.

The Campaign

The victim ran three Active Directory domains that had originally been separate and were later joined with two-way trusts. Those trusts gave the attacker a path from one school environment to the next. The intrusion started from an unmanaged host, a machine outside endpoint protection and central management. The initial access method has not been found.

From there the operator went straight for credential stores and recovery systems:

Timeline

Tradecraft

Most of this is familiar ransomware tradecraft. The new part is the rhythm. Commands that failed were reissued with small syntax changes, which is how an LLM agent behaves when it reads an error and tries again. The steady 40–100 second gap between actions suggests a model call between steps rather than a human operator, who tends to work in bursts.

Some choices still look like a human was directing the work. The attacker went for backup credentials first, named a backdoor account to blend in with backup monitoring (svc_bkpmon), and looked for other schools in logon scripts. That matches the researchers' "human picks the objectives, agent executes" model. Earlier 3AM affiliates also relied on email bombing and fake IT-support calls for initial access, so defenders should not assume a purely technical entry point.

Indicators of Compromise

No network indicators or file hashes have been published. These host-level artefacts are useful for hunting:

Detection

# Defensive: list recently created AD accounts with privileged group membership
Get-ADUser -Filter {whenCreated -ge $((Get-Date).AddDays(-30))} -Properties whenCreated,memberOf |
  Where-Object { $_.memberOf -match 'Domain Admins|Enterprise Admins|Administrators' } |
  Select-Object SamAccountName, whenCreated

Recommended Actions

Analyst Assessment

Whether or not a model was in the loop, this intrusion matches the operating style that governments and researchers have been predicting: fast, persistent, tolerant of errors and inexpensive to scale. The defences that would have stopped it are not new. Managed endpoints, isolated backups, minimal domain trusts and tamper-proof EDR would each have broken the chain. Schools and other under-resourced sectors are the most exposed, because agent-assisted operators lower the cost of attacking many small targets. We rate the threat High.

REEF SENTINEL