Summary
- Bitdefender investigated a nine-day intrusion affecting a UK school environment.
- Attackers compromised credentials, established connections between separate domains, and encrypted approximately 37 systems.
- Researchers identified possible AI-generated commands and agent-like behaviour, but human involvement and the automation mechanism remain unresolved.
A ransomware attack against a UK school estate may have involved AI-generated commands and automated attack activity, although researchers have not established whether an autonomous agent directed the intrusion.
Security company Bitdefender investigated the incident, which involved a 3AM ransomware affiliate operating inside the organisation’s network between 10 and 19 September 2026.
The attacker obtained credentials, expanded access between previously separate administrative domains, interfered with security and recovery systems, and ultimately encrypted approximately 37 machines.
The affected environment contained 47 systems, including servers, workstations, and Active Directory domain controllers. The organisation has not been publicly identified.
Bitdefender’s investigation attributes the intrusion to a 3AM ransomware affiliate based on the encryptor and associated activity. The suspected use of AI is a separate assessment with a lower level of certainty.
Administrative access enabled expansion
The researchers could not determine how the attacker originally entered the environment, as the available telemetry began after access had already been established.
Once inside, the operator used Windows administration capabilities and offensive tools to examine the network and obtain additional permissions.
Investigators identified attempts to extract credentials from backup infrastructure and other systems, including material that could support further movement through the network.
The school environment initially contained several separate Active Directory domains. Such directories govern accounts, permissions, and access to resources within an organisation.
The attacker examined relationships between those domains and searched administrative shares for information about other schools and their network arrangements.
After obtaining sufficient privileges, the operator established two-way trust relationships between three domains. This allowed authentication relationships to extend across previously separate administrative boundaries.
Additional privileged accounts were created with names intended to resemble legitimate accounts within the school environment.
The intrusion then progressed towards disabling endpoint protection and interfering with backup systems before encryption.
These actions followed a recognisable ransomware pattern: expand access, weaken defensive controls, reduce recovery options, and deploy the encryptor across as many reachable systems as possible.
Command behaviour suggests AI assistance
Bitdefender identified sequences of commands that repeatedly adjusted their behaviour after unsuccessful attempts.
The commands and their timing suggested that a language model may have generated portions of the activity. Some retries occurred at relatively consistent intervals, resembling a program that receives technical feedback and requests another action from a model.
However, the available evidence does not establish that such a program was present.
A human operator copying commands between a terminal and an AI assistant could produce similar patterns, while a mixture of manual direction and automated execution could explain the differences in timing between tasks.
Bitdefender could not examine the unmanaged system from which the attacker appeared to operate, limiting its ability to reconstruct the mechanism.
The company therefore distinguishes the evidence for model-generated commands from the less certain possibility of an autonomous agentic loop.
Dray Agha, senior manager, tactical response at Huntress, offered a separate industry perspective in commentary supplied to Cyber Insider.
“Huntress can corroborate that we have observed this AI-augmented tradecraft across a number of ransomware intrusions this year.”
That observation concerns Huntress’s wider investigations and does not independently confirm how the UK school attack was conducted.
School infrastructure and recovery exposure
The affected network included older Windows systems alongside newer devices, reflecting the mixed technology estates commonly found in organisations that have expanded or combined administrative services.
Connections between separate domains can simplify legitimate administration, but they also affect how credentials and permissions operate across organisational boundaries.
In this incident, the attacker deliberately changed those relationships to extend the reach of compromised accounts.
The attempted removal of security software and backups also illustrates how ransomware operators target the systems organisations rely upon to detect an intrusion and recover afterwards.
Those actions have direct consequences for schools, where administrative services, teaching resources, staff accounts, and supporting systems may depend on shared infrastructure.
The suspected AI involvement adds another consideration to the incident, particularly as the NCSC has warned that AI-powered malware is likely to feature in future ransomware attacks against UK critical infrastructure.
Nevertheless, the technical evidence establishes a conventional ransomware intrusion involving credential abuse, administrative manipulation, and encryption. The precise role of AI in directing those activities remains unresolved.
Bitdefender has not disclosed the affected school’s identity or the complete operational and financial consequences of the attack.
