Follow us
Add us as a preferred source on Google
Newsletter
Subscribe to our newsletter
In what it describes as the “first case of this kind”, Bitdefender has uncovered a “hybrid” ransomware attack on UK schools which saw threat actors rely heavily on AI.Apart from the encryptor itself, the whole operation was built on legitimate, built-in tools in a living off the land (LOTL) attack.The attacker worked through PowerShell, Windows Management Instrumentation (WMI) – the built-in interface for running commands on other machines – reg, netsh, rundll32 and the domain and scheduling utilities that ship with Windows.Notably, Bitdefender researchers said the attacker’s behavior during the campaign was unusual, indicating the use of an “agentic loop” – a program that feeds each result back to a model and runs what comes back.Put simply, researchers said it appears that a human threat actor picked objectives, while an AI agent handled repetitive execution, interpreted command outputs, and retried failed actions.”The commands carry the usual tells of a model: a call to the backup software’s web interface (Veeam, a widely used enterprise backup product) on a port and with a login method that do not match the vendor’s documentation, a mistake typical of writing from memory rather than from the manual (Veeam REST API authorization), along with confirmation files, self-labeled output and numbered revisions of the same script,” said the firm. “The retries behave like a loop too.”Prepare for more ‘hybrid AI’ attacksOn 13 September, the attacker ran a PowerShell command, re-ran it unchanged 41 seconds later, changed a single call 49 seconds after that, and then, 47 seconds later, abandoned PowerShell for wmic, the older built-in command-line interface to WMI.Sign up today and you will receive a free copy of our Future Focus 2026 report – the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.According to Bitdefender, the complete rewrite arrived very quickly – and faster than it would be possible to write it by hand.This hybrid approach makes economic sense for attackers, researchers said, with a human setting the goals and a model handling the mechanical work.Long-term, the security firm expects this to become a common tactic among threat actors.”We can expect hybrid attacks like this one to become more common in 2027,” said the firm.3AM behind the attacksBitdefender said it’s confirmed that the attack on schools came from the 3AM group, which operates on a Ransomware as a Service (RaaS) model. The core group develops the encryptor and leases it to affiliates who carry out the intrusions and share the proceeds.The machine list held 47 systems: about 21 servers, eight of them domain controllers; 10 workstations still on Windows 10, which left support in October 2025; one domain controller on the older Windows Server 2012 R2; and the rest on Windows 11.The environment began as several separate Active Directory domains – separate account directories – that weren’t connected to each other.”The attacker’s reconnaissance was specific to the sector. From a domain controller it enumerated trust relationships between domains and searched SYSVOL (the shared folder where Active Directory stores logon scripts, readable by any domain user) for the names and subnets of other schools,” Bitdefender said.”The two backdoor domain-administrator accounts it created, library and svc_bkpmon, carried names chosen to blend into a school’s account list.”Bitdefender said it hasn’t been able to work out how the attacker gained initial access. However, the company said it will be looking out for more cases like this one and for whether the playbook spreads.How to stay secureOrganizations need to act fast to counter future attacks, according to Bitdefender. The company advised firms to keep administrative accounts for specific domains separate and never keep privileged credentials for several domains in one place.They should also view backups as a key target and review strategies for malicious intent. Elsewhere, the company urged firms to restrict remote execution and administrative shares, and block interpreters and shells on machines that never use them.Cybersecurity firm Huntress also spotted the attack unfolding and came to a similar conclusion.“Huntress can corroborate that we have observed this AI-augmented tradecraft across a number of ransomware intrusions this year. I expect we will also see a rapid increase in this type of automated attacker behaviour over the next year,” said Dray Agha, the firm’s senior manager for tactical response.”Cyber criminals no longer need deep technical knowledge to modify their methods and evade network security controls. They can rely on artificial intelligence tools to test different attack paths repeatedly until a system breaks. Educational institutions manage large networks with limited resources and this makes them highly vulnerable and lucrative targets.”FOLLOW US ON SOCIAL MEDIAFollow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
——————————————————–
Click Here For The Original Source.
