Bitdefender says a 3AM ransomware affiliate hit a UK school estate in what it calls the first case it has investigated where part of the attack reads like an agentic loop.
The evidence
- Commands re-run with tiny edits at machine-like gaps, 40 to 101 seconds no matter how big the change
- About 37 of nearly 50 reachable machines were encrypted, starting from an unmanaged host
- Credentials were pulled from three Veeam backup servers, and two backdoor domain admin accounts were created
The honest caveat
Bitdefender couldn’t get to the attacker’s machine, so it can’t name a model or rule out copy-paste. It calls the hybrid reading “the working model defenders should plan around, not an established fact.”
My take
Agents don’t need new tricks. They just retry old ones faster. Lock down the backup servers, watch for new domain admins, and get unmanaged boxes off the network.
God Bless, and Use the Source!
