A UK school estate was compromised by the 3AM ransomware group via a unique hybrid human-AI operation, an investigation by Bitdefender has found.

The incident, which took place from September 10 to 19, 2026, resulted in the attackers’ encrypting 37 machines and building domain trust in the compromised estate to reach other schools.

Notably, the investigation revealed that parts of the post-compromise techniques were undertaken by a human operator at the keyboard, while other parts behaved like an AI agent.

Bitdefender described the attack as “the first case of this kind that we have documented in Europe.”

The researchers continued: “What this attack does show is that the hybrid approach works, and we assess that it makes economic sense for attackers, with a person setting the goals and an [AI] model handling the mechanical work. We can expect hybrid attacks like this one to become more common in 2027.”

How 3AM’s Hybrid Attack Unfolded

The research blog, published on November 3, attributed the attack to a 3AM ransomware affiliate. 3AM is a ransomware-as-a-service (RaaS) operation, whose Rust-based encryptor was first observed in February 2023.

The researchers were not able to determine how the attacker gained initial access to the school estate. The first recorded activity started on September 10, when the attackers’ accessed credentials stored the estate’s backup infrastructure, before decrypting them with the Windows Data Protection API.

From September 12-13, the threat actor tested connections to other hosts from a machine where SQL Server was the parent process. They sent a sequence of commands to the target’s Windows Management Instrumentation (WMI) service, authenticating with stolen administrator credentials. The commands’ outputs were then read by either a person or AI model, who would then choose the next command and repeat the cycle.

A PowerShell command was first used, and re-ran unchanged 41 seconds later, before a single call was changed 49 seconds after that. Next, 47 seconds later, PowerShell was replaced with wmic, the older built-in command-line interface to WMI.

The researchers noted that the fact the complete rewrite arrived as fast as the minor changes before it indicates the commands were written by an AI agent.

The next nine retries followed a similar pattern of the delay before the next command being issued taking between 40 to 101 seconds, whatever the size of the change, while moving on to a new task to minutes.

“That split, longer time between tasks and shorter between retries, is what it looks like if a person is choosing the next step and a model is handling the retries,” the Bitdefender researchers wrote.

In contrast, later commands before the retry sequence were simpler and were sent between two and 16 minutes apart indicative of the pace of someone reading the output and deciding what to do next.

On September 14, the attacker made efforts to gain persistence in the compromised environments. These include running credential dumping tool Mimikatz and creating two backdoor domain-administrator accounts by separate routes.

Next, the attackers copied and 40 financial-related files via the Windows robocopy tool, which were subsequently exfiltrated to their command-and-control (C2) endpoint using HTTP POST.

“The registry-as-transport channel is an unusual choice and a strong indicator to hunt for,” the researchers noted.

On September 19, the attacker joined three separate Active Directory domains with two-way trusts and pushed the backdoor account’s access across the estate within an approximately three-hour window. The researchers said this part of the attack was the clearest example of the hybrid human-AI approach being deployed.

The work involved in joining the estate’s separate domains is highly mechanical, requiring it to be set up correctly on both sides, with one wrong detail stopping everything.

The attackers built the trusts and then ran a series of diagnostic probes and restarted the service that maintains the secure channel between domains. Bitdefender said the hybrid human-AI model suits this work, involving repetitive configuration where the fix comes from a human reading the error.

This work resulted in the attackers reaching 50 machines from the unmanaged host.

Finally, the threat actor made attempts to remove endpoint detection and response (EDR) tools, before decrypting 37 out of the 50 machines accessed.

How to Defend Against Hybrid AI Ransomware Attacks

Bitdefender noted that the attack involved typical approaches observed in other ransomware incidents, including backup credential theft, rogue domain administrators, trusts between domains and use of built-in legitimate tooling.

However, the hands-on work was split between human and AI operators, making use of their respective abilities.

“The approach looks pragmatic: the model takes the mechanical, repetitive work, and nothing in it needed skill or spend that these attackers did not already have,” the researchers commented.

They also noted that the involved of an AI model changes what the traces look like during an incident.

Bitdefender offered the following recommendations for defenders to protect against future attacks that follow a similar playbook:

• Keep the administrative accounts of separate domains separate, and never keep privileged credentials for several domains in one place
• Treat backup infrastructure as a target, and review your backup strategy for malicious intent
• Restrict remote execution and administrative shares
• Block interpreters and shells on machines that never use them
• Put an endpoint agent on every machine