# UK School Ransomware Attack Shows Hybrid AI Tactics

*Published November 4, 2026*
*Source: [https://www.darkreading.com/data-privacy/3am-affiliate-ai-loops-european-school-attack](https://www.darkreading.com/data-privacy/3am-affiliate-ai-loops-european-school-attack)*

## Executive Summary

A ransomware attack on a UK school by a 3AM affiliate used AI-like loops for command automation, suggesting a shift towards hybrid human-AI operations. This approach highlights potential vulnerabilities in critical sectors, underscoring the need for robust traditional defenses against evolving cyber threats.

## Article

A recent ransomware attack on a UK school estate has been analyzed by Bitdefender, revealing a potential shift in how cybercriminals could integrate AI into their operations. This attack, attributed to a 3AM ransomware affiliate, involved conventional methods but was notable for using AI-like command loops to manage repetitive tasks. The attackers infiltrated the school system, leveraging standard Windows tools to build domain trusts and access other schools within the estate.

The process involved stealing backup credentials, creating unauthorized domain-admin accounts, and establishing connections between previously isolated Active Directory domains. Data was exfiltrated and the 3AM ransomware was deployed, following a ransomware playbook. However, Bitdefender's research suggests that AI was used to automate parts of the operation, specifically in generating and retrying commands.

The attack demonstrated the use of living-off-the-land techniques, employing tools already present in the system like PowerShell and Windows Management Instrumentation. An Impacket-style remote execution tool, Mimikatz, and a Veeam script were also utilized. Despite the attack's typical nature, the involvement of AI in handling repetitive tasks marks a significant development, pointing towards a hybrid model where human operators and AI systems collaborate.

Bitdefender noted that while they couldn't directly access the attacker's machine to confirm the AI's role, the behavioral patterns observed suggest a mix of human decision-making and automated command execution. The longer time between tasks but shorter retries was indicative of a human choosing actions with an AI managing retries. This hybrid approach, according to Martin Zugec of Bitdefender, may be more feasible for financially motivated cybercriminals due to its technical and economic advantages.

The attack on the educational institution highlights the need for vigilance as similar sectors could become targets. The good news is that traditional ransomware defenses remain effective against such hybrid attacks. Strategies include separating admin credentials across domains, treating backups as targets for protection, restricting remote execution, and ensuring robust endpoint security measures. Repetition rather than speed was the giveaway in this attack, emphasizing the importance of prevention strategies that are effective regardless of attack volume or pace.