By 
In the early hours of a September morning, a UK school estate fell victim to a sophisticated ransomware attack carried out by a group known as 3AM. This incident saw around 37 out of nearly 50 targeted machines encrypted, signalling a significant breach in what should have been a secure educational environment. Security experts suggest that the attackers may have harnessed artificial intelligence to optimise their malicious activities, marking a troubling evolution in the tactics employed by cybercriminals.
Researchers from cybersecurity firm Bitdefender have described the operation as potentially utilising AI-generated commands within an automated framework. Although they lacked direct access to the attacker's machine, the sequence of commands observed suggested an adaptive loop where slight modifications were made at intervals ranging from 40 to 100 seconds, enabling the attackers to execute their plan with alarming efficiency.
The attack unfolded from September 10 to 19, and while Bitdefender could not pinpoint the initial entry method used by the perpetrators, the complexity of the operation indicates an advanced level of planning. The attackers employed a modified version of a public PowerShell tool to extract and decrypt sensitive credentials stored across three Veeam backup servers, indicating a thorough preparatory stage prior to executing their malicious intentions.
In addition to stealing credentials from the Veeam servers, the attackers also copied a database from Chrome containing various login credentials and deployed several powerful tools, such as Mimikatz and LSASS memory-dumping utilities. These allow for the extraction of stored passwords and other confidential information, showcasing a calculated effort to gather as much sensitive data as possible before executing their ransomware payload.
One of the more alarming aspects of this attack was the way the threat actor mapped domain relationships and searched through logon-script folders for references to other schools. This capability enabled them to create two backdoor accounts with administrative privileges, named ‘library’ and ‘svc_bkpmon’, further demonstrating the extent of their infiltration into the school's network.
As the operation progressed, the attackers sought to establish two-way trusts between three previously isolated Active Directory domains, significantly widening their access across the network. In doing so, they extracted financial data from the compromised machines, amplifying the potential damage caused by their actions.
Towards the conclusion of this orchestrated attack, the hackers attempted to disable security solutions from Sophos and Bitdefender on any accessible host systems. They also aimed to delete system-state backups and deploy the 3AM ransomware's Rust-based encryptor, successfully encrypting files on approximately 37 machines.
The emergence of the 3AM ransomware threat can be traced back to early 2023, when it gained notoriety for deploying a Rust-based ransomware variant following the disruption of operations at LockBit, another ransomware group. Analysts have drawn connections between 3AM and other notorious gangs, such as Conti and Royal, showcasing how techniques are being shared and evolved within the cybercriminal underworld. The use of tactics such as email bombing and spoofed IT support calls has been observed, demonstrating the increasing sophistication of these attacks.
Previous incidents involving different victims provide further context for the growing threat of 3AM. For instance, in August 2024, Kootenai Health suffered an attack that compromised personal information of over 464,000 patients, highlighting that no sector is immune to ransomware dangers.
The implications of AI's involvement in these attacks are noteworthy; while it remains unclear how extensively AI tools were integrated into this specific incident, Bitdefender's analysis indicates a pattern of experimentation by threat actors seeking to leverage advanced technologies for malicious purposes. This evolving landscape of cyber threats has drawn the attention of government agencies, including the National Cyber Security Centre (NCSC) in the UK, which recently published a report urging critical infrastructure sectors to bolster their defences against anticipated AI-powered ransomware attacks over the coming years.
Source: bleepingcomputer.com
