3AM Ransomware Attack on UK Schools Raises Questions About AI-Assisted Hacking
Researchers uncover signs of possible AI-assisted hacking in a 3AM ransomware attack on UK schools, raising new questions for digital forensic investigators.
Cybersecurity researchers have uncovered evidence suggesting that artificial intelligence may have assisted a ransomware attack against schools in the United Kingdom, although the exact role of AI remains unconfirmed.
In research published on November 3, Bitdefender examined an intrusion attributed to an affiliate of the 3AM ransomware group. The attackers compromised a network of schools and encrypted approximately 37 computers.
The investigation identified unusual patterns in how the attackers executed and revised commands. Some operations appeared to involve deliberate human decisions, while repeated troubleshooting attempts occurred at relatively consistent intervals.
During one sequence, failed commands were modified and retried within approximately 40 to 101 seconds, regardless of how extensive the changes were.
Researchers suggested that this behaviour was consistent with an AI agent processing command results and generating subsequent instructions.
However, Bitdefender could not examine the computer from which the attacker operated. Investigators therefore could not confirm whether an AI model automatically controlled these attempts or whether a human manually transferred information between an AI assistant and the compromised systems.
The attackers primarily relied on legitimate Windows administration utilities, including PowerShell and Windows Management Instrumentation, rather than entirely new hacking tools.
They also manipulated Active Directory trust relationships, accessed credentials, and attempted to disable endpoint security before deploying ransomware.
For digital forensic investigators, the case demonstrates why command histories, execution timestamps, authentication records, and network logs are essential for reconstructing attacker behaviour.
It also highlights the difficulty of attributing actions to artificial intelligence based solely on observable patterns.
Although the evidence supports the possibility of AI-assisted operations, it does not establish that the attack was autonomous.
The findings suggest that future ransomware investigations may increasingly need to distinguish between human-directed activity, automated scripts, and AI-assisted decision-making.