UK school estate agentic AI attack — Nov 2026

What happened

Bitdefender researchers identified a hybrid ransomware operation targeting a UK school estate, where a 3AM ransomware affiliate combined human-led strategy with an autonomous AI agentic loop. The attacker utilized a "living off the land" (LOTL) approach, relying on built-in Windows tools like PowerShell, WMI, and netsh to conduct reconnaissance, credential theft, and lateral movement. While the overall strategy followed a conventional ransomware-as-a-service playbook, the execution of repetitive, mechanical tasks—such as configuring domain trusts and diagnostic probing—exhibited behavior consistent with an agentic loop. This loop fed command outputs back into a language model, which then generated subsequent commands, retried failed operations, and performed self-correction.

The incident involved the creation of two-way trusts between previously independent Active Directory domains, a complex task that the agentic loop managed by iterating through diagnostic probes and configuration adjustments. The attack was characterized by a distinct cadence: while human-led tasks occurred at intervals of several minutes, the AI-driven retry sequences consistently occurred every 40 to 101 seconds. The researchers noted that the commands contained specific errors typical of a model reconstructing calls from memory rather than documentation, such as incorrect port numbers for backup software APIs and Unix-style syntax errors within Windows command lines.

Despite the use of AI, the attack did not employ novel malware; it relied on public tools like Mimikatz and Impacket-style remote execution modules. The attacker successfully staged data in the registry and exfiltrated it to an unmanaged host before deploying the 3AM encryptor to 37 machines. The researchers emphasized that the agentic loop was not subtle, leaving behind significant "noise" in the form of numbered script revisions, probe files, and repetitive command patterns. Because the attacker operated from an unmanaged host, the researchers could not definitively confirm the specific language model used or whether a human was manually copying and pasting instructions between the model and the target environment. The incident serves as a pragmatic example of how attackers are integrating AI to handle repetitive, order-sensitive configuration work while maintaining human oversight for high-level goals.