Buyuk Britaniyadagi maktab tizimiga 3AM ransomware filiali hujum qildi va boshqarilmaydigan xostdan erishilgan deyarli 50 ta mashinaning 37 tasini muvaffaqiyatli shifrladi.
Bitdefender kiberxavfsizlik kompaniyasi tadqiqotchilari tahdid aktori operatsiyani amalga oshirish uchun AI tomonidan yaratilgan buyruqlar va avtomatlashtirilgan agentlik tsikldan foydalangan bo'lishi mumkin, deb hisoblashadi.
Xulosa har bir urinishda biroz o'zgartirilgan va taxminan 40-100 soniya muntazam oraliqlarda berilgan takroriy buyruqlar ketma-ketligiga asoslanadi.
"Biz hujumchi ishlagan mashinaga kirish imkoniga ega emas edik, shuning uchun til modeli haqida hech narsani hujjatlashtira olmaymiz: qaysi model ekanligi, u mahalliy yoki masofadan ishlaganmi, yoki hatto biror kishi implant va model o'rtasida ko'rsatmalar va natijalarni nusxalab o'tkazganmi," deb tushuntiradi Bitdefender.
Tadqiqotchilar faqat xatti-harakatni hujjatlashtira olganliklarini va bu agentlik tsiklga o'xshash ko'rinishini ta'kidlaydilar.
Hujum umumiy ko'rinishi Manba: Bitdefender
Zararli faoliyat 10-19 sentyabr oralig'ida sodir bo'lgan, ammo Bitdefender hujumchining dastlabki kirish usulini aniqlay olmagan.
Tahdid aktori uchta Veeam zaxira serverida saqlangan ma'lumotlarni chiqarish va shifrlash uchun o'zgartirilgan ommaviy PowerShell vositasidan foydalangan, ma'lumotlarni o'z ichiga olgan Chrome ma'lumotlar bazasini nusxalagan va Mimikatz hamda LSASS xotira-dump vositalarini joylashtirgan.
Ular domen munosabatlarini xaritalashgan va boshqa maktablarga havolalar uchun kirish skriptlari papkalarini qidirgan, natijada 'library' va 'svc_bkpmon' nomli ikkita orqa eshik domen administrator hisobini yaratgan.
Buzilgan mashinalardan moliyaviy ma'lumotlarni o'g'irlagandan so'ng, hujumchi o'z ta'sir doirasini kengaytirish uchun avval alohida bo'lgan uchta Active Directory domeni o'rtasida ikki tomonlama ishonchni sozlagan.
Hujumning yakuniy bosqichida ular erishiladigan xostlardan Sophos va Bitdefender himoyasini olib tashlashga, tizim holati zaxiralarini o'chirishga va 3AM'ning Rust asosidagi shifrlovchisini joylashtirishga urinishgan. Ular taxminan 37 ta holatda muvaffaqiyatga erishgan.
Hujum xronologiyasi Manba: Bitdefender
3AM ransomware tahdidi 2023 yilda paydo bo'lgan va LockBit bloklangandan so'ng hujumchi uning Rust asosidagi ransomware'ini joylashtirganda ommaviy e'tiborga tushgan.
Keyinchalik tadqiqotchilar operatsiyani Conti va Royal ransomware guruhlari bilan bog'lashgan va filiallar korporativ tarmoqlarga kirish uchun elektron pochta bombardimoni va soxta IT qo'llab-quvvatlash qo'ng'iroqlaridan foydalanayotgani kuzatilgan.
E'tiborga molik o'tmish qurboni — Kootenai Health, u yerda 2024 yil avgust oyidagi hujum 464 000 dan ortiq bemorning shaxsiy ma'lumotlarini fosh qilgan.
3AM hujumlarida AI vositalarining hozirgi ishtirok darajasidan qat'i nazar, Bitdefender kuzatishlari tahdid aktorlari ular bilan faol tajriba o'tkazayotganga o'xshaydi.
Bugun ertaroq Buyuk Britaniyadagi NCSC bu yilgi 'The State of the Cyber Nation' hisobotini e'lon qildi va muhim infratuzilmani 2028 yilgacha AI quvvatlangan ransomware hujumlariga tayyorlanishga chaqirdi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, kontekst va xatti-harakatni tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizlik skaneringizni boshlang.
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.
Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.
The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds.
"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," Bitdefender explains.
The researchers note that they could only document the behavior, and it looked similar to an agentic loop.
Attack overview Source: Bitdefender
The malicious activity spanned between September 10 and19, but Bitdefender could not establish the attacker’s initial access method.
The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.
They mapped domain relationships and searched logon-script folders for references to other schools, eventually creating two backdoor domain administrator accounts named ‘library’ and ‘svc_bkpmon.’
After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach.
In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor. They succeeded in about 37 cases.
Attack timeline Source: Bitdefender
The 3AM ransomware threatemerged in 2023 and came to public attention when an attacker deployed its Rust-based ransomware after LockBit was blocked.
Researchers later linked the operation to the Conti and Royal ransomware gangs, and affiliates have been observed using email bombing and spoofed IT support calls to access corporate networks.
A notable past victim is Kootenai Health, where an August 2024 attack exposed personal information belonging to more than 464,000 patients.
Regardless of the current level of AI tool involvement in 3AM attacks, Bitdefender’s observations suggest the threat actors appear to be experimenting with them heavily.
Earlier today, the NCSC in the UK published this year’s ‘The State of the Cyber Nation’ report, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.