A ransomware attack on a UK school estate encrypted about 37 of nearly 50 machines, according to security company Bitdefender, which investigated the incident.
How the attack unfolded
- The attacker was an affiliate of the 3AM ransomware operation.
- They entered through an unmanaged computer — a device not covered by the organisation's security tools.
- They created trust relationships between three Active Directory domains, giving them wider access.
- They then deployed an encryption program written in Rust.
Was AI involved?
Bitdefender saw signs of an "agentic loop" — a pattern consistent with an AI system planning and running commands. However, it could not identify the model or confirm whether a human was simply copying commands from an AI tool.
Lessons for schools and small organisations
- Know every device on your network. Unmanaged machines are a common way in.
- Keep offline backups so systems can be restored without paying.
- Use multi-factor authentication for administrator accounts.
- Monitor changes to admin accounts and domain settings.
Sources
Was this article helpful?
Comments & ratings
No comments yet. Be the first to share your view.