3AM nomi bilan tanilgan ransomware sherigi Buyuk Britaniya maktab tarmog'iga an'anaviy kirish usullari va sun'iy intellekt ishtirokini ko'rsatuvchi naqshlar aralashmasi yordamida hujum qildi.
Bitdefenderning 3-noyabrdagi tekshiruviga ko'ra, bu operatsiya gumon qilingan gibrid ish oqimini kuzatadi: inson operator nishonlarni tanlaydi, til modeli esa takrorlanuvchi vazifalar va nosozliklarni bartaraf etish bilan shug'ullanadi. Biroq tadqiqotchilar to'liq avtomatlashtirilgan operatsiyalar hali isbotlanmaganini ta'kidlaydi.
Buzilgan muhit 47 tizimni o'z ichiga olgan, jumladan taxminan 21 server va sakkizta domen nazoratchisi. Dastlab bu Active Directory domenlari alohida edi, ammo hujumchi ikki tomonlama ishonchni o'rnatib, butun tarmoq bo'ylab kirish imkoniyatini yaratdi. Dastlabki kirish usuli noma'lum qolmoqda.
Sherik asosan PowerShell, Windows Management Instrumentation, registr utilitalari, rejalashtirilgan vazifalar va boshqa qonuniy Windows komponentlariga tayandi. Ommaviy vositalar orasida Mimikatz, Impacket uslubidagi masofaviy bajarish utilitalari va o'zgartirilgan Veeam ma'lumotlarini tiklash skripti bor edi.
Bu yondashuv 3AM ransomware o'yin kitobiga mos keladi, yangi zararli dastur platformasini joriy etmaydi. O'ziga xos dalillar buyruq tuzilishida, takrorlanuvchi xatolarda va tuzatishlar vaqtida paydo bo'ldi.
13-sentabrda bitta PowerShell buyrug'i 41 soniyadan so'ng o'zgarmagan holda takrorlandi. Yana 49 soniyadan keyin boshqa tuzatish keldi, faqat chiqish usulini o'zgartirdi. Yana 47 soniyadan so'ng hujumchi PowerShellni WMIC bilan almashtirdi.
To'qqizta urinish davomida intervallar tuzatish murakkabligidan qat'i nazar 40 dan 101 soniyagacha o'zgarib turdi. Turli vazifalar orasida uzunroq tanaffuslar kuzatildi. Tadqiqotchilar bu ritmni inson tomonidan boshqariladigan, agentik tsikl bilan qo'llab-quvvatlanadigan ish sifatida talqin qildilar, garchi chatbot va qobiq o'rtasida qo'lda nusxa ko'chirish ham shunga o'xshash xatti-harakatni keltirib chiqarishi mumkin.
How Impacket's wmiexec runs a command on a target machine (Manba: BitDefender)
Sentyabr oyida qayd etilgan faoliyat uchta zaxira serveridan ma'lumot o'g'irlash bilan boshlandi. O'zgartirilgan skript Veeam ma'lumotlar bazalarini so'radi va Windows Data Protection API funksiyasidan foydalanib saqlangan maxfiy ma'lumotlarni shifrladi.
Keyin hujumchi Chrome ma'lumotlar bazasini nusxaladi, sezgir registr uyalarini eksport qildi va Mimikatzni noto'g'ri nomlar, jumladan sysmon64.exe ostida joylashtirdi. Ikkita noqonuniy domen-administrator hisoblari, library va svc_bkpmon, ortiqcha barqarorlikni ta'minladi.
Bu harakatlar zaxira infratuzilmasi xavfsizligi tiklanishdan tashqari ham muhim ekanligini ko'rsatadi: saqlangan ma'lumotlar kengroq buzilishni qo'llab-quvvatlashi mumkin. Biroq tekshiruvchilar Veeam zaifligini kirish nuqtasi sifatida aniqlamadilar.
15-sentabrda hujumchi moliyaviy hujjatlarni Base64-kodlangan registr qiymatlari sifatida tayyorladi, fayllarni qo'shimcha joylarga nusxaladi va boshqarilmaydigan ichki xostga HTTP POST orqali arxiv yukladi.
Bu mashina ham buyruq va nazorat nuqtasi sifatida ishladi. Tekshiruvchilar uni tekshira olmagani uchun model, joylashtirish tartibi yoki avtomatlashtirish tizimini aniqlay olmadilar.
18-sentabrda sherik uchta domenni bog'laydigan ikki tomonlama ishonchni o'rnatdi, so'ngra diagnostik tekshiruvlar o'tkazdi va xizmatni qayta ishga tushirdi, domenlararo xavfsiz kanallarni saqlab qoldi.
19-sentabrda ketma-ket skriptlar yakuniy himoyani olib tashlashga urindi, ammo o'zgartirishga qarshi nazoratlar olib tashlashni to'xtatdi. Taxminan 40 ta mashinaga yuklovchi joylashtirildi, so'ngra Rust asosidagi ThreeAM shifrlovchi 05:07 dan 05:33 UTC gacha ishga tushdi va tizim holati zaxiralarini o'chirib tashladi.
Gumon qilingan AI ko'rsatkichlari orasida noto'g'ri Veeam API taxminlari, Windows buyruqlari ichida Unix uslubidagi sintaksis, raqamlangan skript tuzatishlari va tasdiqlovchi fayllar bor edi. Alohida bu artefaktlar model ishtirokini isbotlamaydi.
Bu holat agent yordamidagi ransomware operatsiyalari haqidagi xabarlarga mos keladi, ammo bitta tekshiruv bo'lib, kengroq avtonom ransomware tendensiyasining dalili emas.
Himoyachilar kutilmagan domen ishonchlari, imtiyozli hisob yaratish, zaxira ma'lumotlariga kirish, registr uyasi eksportlari va registr asosidagi fayl tayyorlashning g'ayrioddiy holatlariga e'tibor qaratishlari kerak.
Bitdefender tadqiqotlari markaziy farqni ta'kidlaydi: tanish hujum usullari bajarilish AI ishtirokini o'z ichiga olishi mumkin bo'lsa ham, aniqlanadigan holatda qoladi. Ishonchli shaxs, yakuniy nuqta va tarmoq telemetriyasi faoliyatni qayta tiklash va tekshiruvlar davomida avtomatlashtirish da'volarini sinash uchun muhim bo'lib qoladi.
SOCingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering. 16K SOCdan tahdid razvedkasini integratsiya qiling.
A ransomware affiliate known as 3AM compromised a UK school network using a mix of traditional intrusion techniques and patterns suggesting the involvement of artificial intelligence.
According to Bitdefender’s investigation on November 3, this operation appears to follow a suspected hybrid workflow: a human operator selects the targets while a language model may handle repetitive tasks and troubleshooting. However, researchers emphasize that fully automated operations have not yet been proven.
The compromised environment included 47 systems, comprising approximately 21 servers and eight domain controllers. Initially, these Active Directory domains were separate, but the attacker established two-way trusts, allowing access across the entire network. The initial access method remains unknown.
The affiliate relied primarily on PowerShell, Windows Management Instrumentation, registry utilities, scheduled tasks, and other legitimate Windows components. Public tools included Mimikatz, Impacket-style remote execution utilities, and a modified Veeam credential-recovery script.
This approach follows the established 3AM ransomware playbook, rather than introducing a fundamentally new malware platform. The distinctive evidence appeared in command construction, repeated mistakes, and the timing of revisions.
On September 13, one PowerShell command was repeated unchanged after 41 seconds. Another revision followed 49 seconds later, changing only its output method. After another 47 seconds, the attacker replaced PowerShell with WMIC.
Across nine retries, intervals ranged from 40 to 101 seconds regardless of revision complexity. Longer gaps separated different tasks. Researchers interpreted this rhythm as consistent with human-directed work supported by an agentic loop, although manual copying between a chatbot and shell could produce similar behavior.
How Impacket’s wmiexec runs a command on a target machine (Source: BitDefender)
Recorded September activity began with credential theft from three backup servers. A modified script queried Veeam databases and decrypted stored secrets using Windows Data Protection API functionality.
The attacker subsequently copied Chrome’s credential database, exported sensitive registry hives, and deployed Mimikatz under misleading filenames, including sysmon64.exe. Two rogue domain-administrator accounts, library and svc_bkpmon, provided redundant persistence.
These actions illustrate why backup infrastructure security matters beyond recovery: stored credentials can support broader compromise. However, investigators did not identify a Veeam vulnerability as the entry point.
On September 15, the attacker staged finance documents as Base64-encoded registry values, copied files into additional locations, and uploaded an archive through HTTP POST to an unmanaged internal host.
That machine also acted as a command-and-control endpoint. Because investigators could not examine it, they could not identify a model, hosting arrangement, or automation framework.
On September 18, the affiliate established two-way trusts connecting three domains, then performed diagnostic checks and restarted the service, maintaining interdomain secure channels.
On September 19, successive scripts attempted to remove endpoint protection, but anti-tampering controls blocked removal. A loader was deployed to approximately 40 machines before the Rust-based ThreeAM encryptor executed between 05:07 and 05:33 UTC, deleting system-state backups during deployment.
The suspected AI indicators included incorrect Veeam API assumptions, Unix-style syntax inside Windows commands, numbered script revisions, and confirmation files. Individually, these artifacts do not prove model involvement.
The case complements reporting on agent-assisted ransomware operations, but remains one investigation, not evidence of a wider autonomous-ransomware trend.
Defenders should prioritize unexpected domain trusts, privileged account creation, backup credential access, registry-hive exports, and unusual registry-based file staging.
Bitdefender’s research coverage underscores the central distinction: familiar attack techniques remain detectable even when execution may involve AI. Reliable identity, endpoint, and network telemetry remains essential for reconstructing activity and testing automation claims during investigations.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
