According to Bitdefender’s technical analysis, the 3AM ransomware affiliate who attacked UK schools in September appears to have delegated repetitive command execution to a language model. The evidence is circumstantial but specific: commands arrived at regular 40–100 second intervals, iterating script versions with self-labeling outputs like “TASK-OK,” and making systematic errors (incorrect API ports, bash-style escape sequences in PowerShell) consistent with LLM generation rather than hand-written code.
The researchers assess the attack as hybrid: humans setting strategy, an agentic loop handling execution. They can’t confirm which model, whether it ran locally or remotely, or access the attacker’s infrastructure to verify the core claim.
What matters is that AI has become a viable force multiplier for entry-level intrusion work. Automating retry loops, permission enumeration, and error recovery lowers the operational bar. An affiliate lacking deep expertise can now maintain operational consistency and scale. The barrier to entry just got lower.
Sources: 3AM hits European schools: A hybrid AI ransomware attack
Coverage: 3AM affiliate used AI-like loops in European school attack • UK school estate hit by 3AM ransomware in suspected AI-assisted attack
Related on this blog: [AUTO] Agent Incidents: Identity Records, Not Root Cause • [AUTO] AI Phishing Defenses Outpaced by AI Attack Volume • [AUTO] Spain Reports First Alleged AI-Powered Data Theft