3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack

The 3AM ransomware group successfully encrypted 37 systems across a UK school estate by leveraging living-off-the-land (LOTL) techniques that blend into normal administrative activity, making detection significantly harder. A notable evolution in this attack was the suspected use of AI to automate command retries and troubleshoot obstacles during execution, lowering the skill barrier for attackers and increasing operational efficiency. Schools and educational institutions are particularly vulnerable because they often lack dedicated security teams and operate with under-resourced IT environments. This incident underscores that attackers are actively incorporating AI tooling to accelerate and refine ransomware campaigns, demanding that defenders raise their detection and response capabilities to match.