Follow us on Google News
A ransomware attack against a network of schools in the United Kingdom shows signs that hackers may have used artificial intelligence to generate commands, troubleshoot technical problems and spread across connected computer systems, according to a cybersecurity investigation published on November 3.
Researchers identified the attackers as an affiliate of the 3AM ransomware group, which operates a criminal business model in which affiliates use ransomware developed by others to target organisations.
The September 2026 intrusion affected a school IT environment where the attackers reached approximately 50 computers and encrypted around 37 systems.
The investigation suggests a possible combination of human direction and AI-assisted execution. However, researchers could not establish whether an autonomous AI system was directly operating the attack or whether a person was using AI-generated instructions.
Repeated Commands Raised Suspicions Of AI Involvement
Researchers identified unusual patterns in the commands executed during the intrusion.
On September 13, one attacker-controlled process repeatedly attempted a technical operation, modified commands after unsuccessful attempts and switched between Windows tools.
The attempts occurred at intervals of approximately 40 to 101 seconds, even when substantial changes were made to the commands.
According to the researchers, this pattern resembled an AI system receiving the results of previous commands and generating revised instructions.
Some commands also contained errors and unnecessary steps associated with language models, including attempts to access backup software using incorrect technical specifications.
Such behaviour can occur when an AI system generates plausible-looking instructions without accurately understanding the software involved.
The intervals between separate tasks were longer, suggesting that a human operator may have been deciding the overall direction while automated assistance handled repetitive work.
Cybersecurity researchers describe this possible arrangement as a hybrid human-AI attack.
However, the investigators did not have access to the computer used to control the operation.
They therefore could not identify the AI model, determine whether it operated locally or through an online service, or rule out the possibility that a person manually copied instructions between an AI chatbot and the compromised environment.
Hackers Connected Separate School Networks Before Encryption
The targeted organisation operated several separate Windows network domains, which manage user accounts, computers and permissions.
The attackers initially focused on obtaining administrative credentials from backup servers and other systems.
Between September 10 and 11, they used modified software tools to extract credentials stored in backup infrastructure. They also copied a browser file containing saved login information from another computer.
Subsequent activity involved attempts to collect additional passwords, identify administrator accounts and examine the relationships between different school networks.
The attackers created two unauthorised administrator accounts, giving them alternative ways to maintain access.
On September 18, they configured connections known as domain trusts between three previously separate networks.
A domain trust allows accounts from one network to authenticate in another. Although this does not automatically grant access to every system, the attackers used the newly established relationships alongside administrative permissions to extend their reach.
The investigation found repeated diagnostic commands and adjustments while these connections were being configured.
Researchers believe such repetitive troubleshooting is particularly suitable for AI assistance because the operator must interpret error messages and revise instructions until the configuration works.
By the following morning, ransomware had encrypted dozens of systems across the affected environment.
Backup Systems Targeted Before And After The Attack
The attackers relied heavily on legitimate Windows utilities, including PowerShell and built-in remote administration tools.
This technique is known as living off the land, where criminals misuse software already installed on computers rather than introducing entirely new attack tools.
It can make malicious activity harder to distinguish from routine administration, particularly when attackers obtain privileged accounts.
The 3AM affiliate also used publicly available tools to access credentials and move between computers.
On September 19, the attackers attempted to remove endpoint security software, but protective controls blocked those attempts.
They subsequently deployed the ransomware encryptor, which ran across multiple computers between 05:07 and 05:33 UTC.
The operation also attempted to delete Windows system-state backups, potentially making recovery more difficult.
Backup infrastructure had therefore been targeted at two different stages: first to steal credentials and later to interfere with recovery.
Investigators also identified activity involving files from a finance-related shared folder that were collected and transferred within the compromised environment.
The researchers did not disclose the affected schools’ names or establish the full consequences for students, staff or school operations.
Why AI-Assisted Ransomware Remains Difficult To Prove
The investigation highlights how AI could change the way conventional ransomware attacks are carried out without requiring entirely new malware.
An attacker could potentially use AI to generate commands, interpret technical errors and automate repetitive network administration tasks.
That might allow criminals with limited technical expertise to perform operations that previously required more manual effort.
However, the evidence does not establish that AI independently planned the intrusion, selected its victims or controlled the operation without human involvement.
The researchers also cautioned that this single investigation does not prove that AI-operated ransomware has become widespread.
Most of the techniques observed were familiar to cybersecurity professionals, including password theft, unauthorised administrator accounts, misuse of remote access and attacks against backup systems.
For organisations, the findings reinforce the importance of protecting administrator credentials, monitoring unusual connections between networks and ensuring that security software covers every device.
The investigation identified an unmanaged computer as a major visibility gap because researchers could not observe the activity occurring directly on that machine.
What This Means For You:
Schools and businesses should secure backup systems, restrict administrator access and monitor repeated suspicious commands. AI-assisted attacks may look unfamiliar, but established cybersecurity controls remain important for detecting and containing them.
