Suspected Use of Intelligent Automation
A member of the 3AM ransomware gang targeted a group of schools in the United Kingdom, resulting in the encryption of approximately 37 out of 50 devices accessed via an unmanaged host. What is concerning about this attack is what researchers at Bitdefender revealed regarding the potential use by attackers of AI-generated commands and what is known as an "Agentic Loop" to execute the operation.
The researchers based their conclusion on observing a series of repetitive commands that were slightly modified in each attempt and issued at regular intervals ranging from 40 to 100 seconds, a behavior that indicates the presence of an intelligent automation process attempting to adapt to the target environment automatically.
Technical Details of the Attack
The attacker followed a complex technical path to ensure full control and expand the scope of the breach, which included the following steps:
- Using a modified PowerShell tool to extract and encrypt credentials from three Veeam backup servers.
- Copying Chrome browser databases containing stored credentials.
- Deploying tools such as Mimikatz and LSASS memory dumping techniques to steal digital identities from memory.
- Expanding the scope by creating Domain Administrator accounts with names such as "library" and "svc_bkpmon".
- Configuring two-way trust relationships between previously separate Active Directory domains to increase the ability to move laterally within the network.
In the final stage, the attacker attempted to disable security software such as Sophos and Bitdefender and delete system backups before deploying the Rust-based 3AM encryptor.
What Does This Attack Actually Change?
This incident represents a qualitative shift in the strategies of ransomware groups; instead of relying entirely on human intervention at every step, the use of "Agentic Loops" indicates a growing trend toward automating cyberattacks using artificial intelligence. This development means that attacks could become faster, more capable of evasion, and less dependent on the attacker's manual skill during the reconnaissance and lateral movement phases.
This comes at a time when the National Cyber Security Centre (NCSC) in the United Kingdom, in its latest report, warned of the need for critical infrastructure to be prepared to face AI-supported ransomware attacks expected by 2028.