Bitdefender has documented a 3AM ransomware intrusion at a UK school estate, describing evidence consistent with AI-assisted operations while stopping short of proving an autonomous attacker.
The 3 November report reconstructs activity from 10–19 September 2026. Initial access remains unknown. Bitdefender attributes the attack to a 3AM affiliate and reports roughly 37 machines encrypted.
The attacker stole credentials, created privileged accounts and established two-way trusts between three Active Directory domains. Familiar administration tools carried much of the operation.
The AI assessment rests on command mistakes and repeated attempts spaced 40–101 seconds apart. Bitdefender considers model-generated commands strongly supported, but says a person copying results between a shell and a chatbot could explain the rhythm. Investigators lacked access to the unmanaged host driving the activity and could not identify a model.
This is one investigated estate, not evidence of a continent-wide campaign or an established trend in autonomous ransomware.
Protect recovery before debating the operator
The practical priority is recovery that survives compromised administration. The CISA and MS-ISAC ransomware guide recommends offline, encrypted backups and regular restoration testing. Accessible backups can themselves become targets for deletion, so a successful backup job is only part of the check.
For a school IT team, a useful exercise is to restore a critical service from an isolated copy and record the time, dependencies and credentials required. The result supplies something an AI attribution debate cannot: evidence that recovery works.
