In a recent cybersecurity incident, a group of UK schools fell victim to a sophisticated ransomware attack orchestrated by a combination of human operators and AI-driven automation. The attack, attributed to the 3AM group, involved exploiting built-in Windows tools and using stolen credentials to infiltrate the school networks, encrypting approximately 37 devices in the process.
The Mechanics of the 3AM Ransomware Attack
The 3AM ransomware group, also known as ThreeAM, operates by selling their Rust-based ransomware to affiliates who execute the attack and split the profits. This method allows the group to target small to mid-sized organizations, which aligns with their known attack patterns. According to Bitdefender researchers, the operation was a hybrid of manual target selection and automated execution, likely facilitated by a language model to handle repetitive tasks.
Despite the sophistication of the attack, researchers could not determine the specific AI model used or whether a human was involved in transferring results. This attack targeted a UK school estate comprising 47 systems, including several servers and workstations.
Details of the Attack
The initial breach occurred on September 10th and 11th, when attackers used a modified Veeam script to extract passwords from backup servers. The attackers then employed tools like Mimikatz, disguised as sysmon64.exe, to create fake admin accounts. These accounts, with innocuous names such as “library” and “svc_bkpmon,” were designed to blend within the school’s existing accounts.
On September 13th, the attack showed clear signs of AI involvement. Commands were executed in a pattern consistent with automated retries and adjustments, a hallmark of AI-driven processes. Errors typical of AI-generated commands, such as incorrect ports and misplaced escape characters, were noted.
Response and Implications for Future Security
Bitdefender highlighted that while this instance does not represent a widespread trend, it underscores the potential rise of hybrid AI-human attacks. The attacker’s toolkit was dated, and the encryption software was a standard build, but the method of operation hints at future threats.
Defenders are advised to segregate admin accounts across domains, monitor for new domain trusts, secure backup servers, restrict certain access protocols, and deploy endpoint agents on all devices. This incident resembles other AI-driven ransomware cases, emphasizing the need for proactive measures.
In conclusion, protecting against such threats requires vigilance and adaptation to emerging hybrid attack tactics. Organizations should integrate threat intelligence to anticipate and mitigate potential risks, ensuring robust cybersecurity defenses.
