A ransomware gang locked about 37 computers across a UK school group, and researchers say the way it worked suggests AI may have helped run the attack.
A ransomware gang locked up about 37 computers at a group of UK schools, and security researchers think an AI tool may have helped run the attack. Ransomware is software that scrambles files so the owner has to pay to get them back. The firm Bitdefender investigated and says the group is known as 3AM.
The attackers were inside the network from September 10 to 19 before they locked any files. Bitdefender could not work out how they first got in. They reached nearly 50 machines from one device that nobody was managing, and scrambled about 37 of them.
Along the way, the attackers took several steps to gain control:
At the end, they tried to remove Sophos and Bitdefender protection, delete system backups, and run 3AM's file-scrambling program. It worked on about 37 machines.
Bitdefender saw the same commands repeated, each one slightly changed, roughly every 40 to 100 seconds. That pattern looks like an automated loop, where an AI tool writes a command, sees the result and tries again. The researchers stress they only documented behavior that looked similar to this.
Bitdefender could not get into the machine the attacker worked from. So it cannot say which AI model was used, whether it ran locally or remotely, or whether a person was simply copying and pasting between the attack tool and the model. Still, Bitdefender says the attackers appear to be experimenting with AI heavily.
3AM appeared in 2023 and has been linked to the Conti and Royal ransomware gangs. Its affiliates have used email bombing and fake IT support calls to get into company networks. In August 2024, an attack on Kootenai Health exposed personal data of more than 464,000 patients. Separately, the UK's NCSC urged critical infrastructure to prepare for AI-powered ransomware by 2028.
The attackers went after backup servers first, so backups need extra protection. Any organization can act on two points.
Keep backups separate and locked down, and require two-step login on admin accounts, because attackers target backup servers first.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammersKMBC 9 News has launched Scam School, a series on spotting the warning signs of scam texts and calls so you can protect your money and your family.
Read more: A local TV series shows the warning signs of phone and text scams
