Actor Profile

3AM is a ransomware-as-a-service (RaaS) operation that emerged in 2023, initially observed when an affiliate deployed its Rust-based encryptor after LockBit was blocked. Researchers have linked 3AM to the Conti and Royal ransomware gangs, suggesting operational or personnel overlap with these established cybercrime groups. Affiliates operate with financial motivation, targeting organizations across multiple sectors including healthcare and education. The group has demonstrated evolving tactics, including email bombing and spoofed IT support calls for initial access, and now appears to be experimenting with AI-assisted attack automation.

TTPs (Tactics, Techniques, Procedures)

The affiliate demonstrated sophisticated post-compromise tradecraft including credential harvesting via modified PowerShell tools targeting Veeam backup servers (T1003.001 - LSASS Memory), Mimikatz deployment, and Chrome credential database theft (T1555.003 - Credentials from Web Browsers). The attacker performed Active Directory reconnaissance (T1087.002 - Domain Account Discovery), created backdoor domain administrator accounts named 'library' and 'svc_bkpmon' (T1136.002 - Create Domain Account), and established two-way trusts between three separate AD domains to enable lateral movement (T1484 - Domain Policy Modification). Defense evasion included attempts to remove Sophos and Bitdefender protection (T1562.001 - Disable or Modify Tools) and deletion of system-state backups (T1490 - Inhibit System Recovery). The attack culminated in deployment of 3AM's Rust-based ransomware encryptor (T1486 - Data Encrypted for Impact). Bitdefender observed a pattern of repeated, slightly modified commands issued at 40-100 second intervals, suggesting potential use of an AI-driven agentic loop for command generation and execution.

Targets & Patterns

This campaign targeted a UK school estate, successfully compromising approximately 37 of nearly 50 machines accessed from an unmanaged host. The education sector represents a continuation of 3AM's opportunistic targeting pattern, which has previously included healthcare organizations such as Kootenai Health (464,000+ patient records exposed in August 2024). The attacker demonstrated specific interest in financial data exfiltration and showed methodical reconnaissance of domain relationships, searching logon-script folders for references to other schools within the estate. This suggests intent to maximize impact across interconnected educational institutions. The targeting of education aligns with broader ransomware trends exploiting organizations with limited security resources, distributed IT infrastructure, and pressure to restore operations quickly due to operational disruption impact on students and staff.

Historical Context

3AM ransomware first gained public attention in 2023 when an affiliate deployed it as a backup after LockBit ransomware was blocked by defenses, revealing the group's operational flexibility. Subsequent research linked 3AM operations to the Conti and Royal ransomware ecosystems, suggesting shared infrastructure, tooling, or personnel from these established cybercrime syndicates. Previous 3AM campaigns have employed social engineering techniques including email bombing and spoofed IT support calls for initial access. The August 2024 Kootenai Health attack demonstrated the group's capability to compromise large healthcare organizations and exfiltrate sensitive data at scale. The current UK school attack represents a potential tactical evolution, with Bitdefender assessing that the affiliate may be experimenting with AI-assisted automation for command generation and execution—a development that aligns with UK NCSC warnings in their 2026 'State of the Cyber Nation' report urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.

Defensive Recommendations

  • Monitor for creation of suspicious domain administrator accounts with generic service-oriented names (e.g., 'library', 'svc_bkpmon') and implement privileged account management policies requiring approval workflows for new administrative credentials (T1136.002)
  • Deploy behavioral detection for credential access tools targeting Veeam backup infrastructure and LSASS memory dumping (T1003.001), with alerts on PowerShell scripts accessing backup server credential stores
  • Implement monitoring for unusual Active Directory trust modifications, particularly two-way trust creation between previously isolated domains, with alerting on T1484 Domain Policy Modification events
  • Detect defense evasion attempts through EDR/AV tampering alerts (T1562.001) and correlate with backup deletion activity (T1490) as pre-ransomware indicators requiring immediate incident response
  • Enforce network segmentation to prevent unmanaged hosts from accessing critical infrastructure, and implement NAC solutions to identify and quarantine devices lacking security controls before they can pivot to managed endpoints

---

# Geopolitical Context

Geopolitical Context

The incident reflects the ongoing evolution of cybercriminal tradecraft, with ransomware affiliates potentially incorporating AI-assisted automation into their operational workflows. The 3AM ransomware group, previously linked to the Conti and Royal ransomware ecosystems, has historically demonstrated adaptability in tactics and tooling. The targeting of UK educational infrastructure—a sector characterized by limited cybersecurity resources and high operational sensitivity—aligns with broader patterns of opportunistic ransomware campaigns against soft targets in Western democracies. The suspected use of AI-generated commands and agentic loops, while not definitively confirmed, is consistent with emerging trends flagged by the UK National Cyber Security Centre (NCSC), which has warned critical infrastructure operators to prepare for AI-augmented ransomware by 2028. This incident may represent an early indicator of that trajectory, though the technical evidence remains circumstantial.

State Actor Alignment

The 3AM ransomware operation is assessed to be a financially motivated cybercriminal enterprise with no direct state sponsorship. However, the group's historical lineage traces to the Conti ransomware cartel, which has been linked by Western intelligence agencies to actors operating from or with ties to Russia. Conti's infrastructure and personnel fragmented following Russia's invasion of Ukraine in 2022, with successor groups—including Royal and potentially 3AM—continuing operations under new branding. While there is no evidence of state direction in this specific incident, the permissive operating environment for ransomware actors in certain jurisdictions remains a persistent policy concern for the UK and its Five Eyes partners. The UK government has imposed sanctions on Russia-linked ransomware actors and infrastructure in recent years, though enforcement against decentralized affiliate models remains challenging.

Business Impacty pro region

The attack underscores persistent vulnerabilities in the UK's education sector, which has faced a sustained wave of ransomware incidents over the past three years. Educational institutions across Europe—particularly in the UK, Germany, and France—remain attractive targets due to constrained IT budgets, legacy infrastructure, and the operational imperative to restore services quickly, which may incentivize ransom payment. The incident also has broader implications for European critical infrastructure resilience, as the NCSC's concurrent warning about AI-powered ransomware by 2028 suggests UK authorities are anticipating a qualitative shift in threat actor capabilities. If AI-assisted automation becomes a standard feature of ransomware operations, it could enable affiliates to scale attacks more rapidly and with less technical expertise, potentially overwhelming defensive capacity in under-resourced sectors. This may prompt accelerated policy coordination within NATO and EU frameworks on ransomware deterrence, victim support, and restrictions on cryptocurrency payment rails.

Forecast

If AI-assisted automation in ransomware operations continues to mature, it is likely that the frequency and speed of attacks against soft targets—including education, healthcare, and local government—will increase over the next 12 to 24 months. Defenders may face challenges in distinguishing between human-directed and AI-augmented intrusions, complicating incident response and attribution. If the UK and European governments do not accelerate investment in cybersecurity for the education sector, including endpoint detection, backup integrity, and network segmentation, the sector is likely to remain a high-value target for opportunistic affiliates. Should AI-generated attack automation become commoditized within the cybercriminal ecosystem, it may lower barriers to entry for less sophisticated actors, potentially increasing the volume of ransomware incidents across Europe. Conversely, if defensive AI tools and improved threat intelligence sharing mature in parallel, the window of advantage for attackers may narrow by late 2027.