Picture an intruder who never gets tired, never stops to think, and retries a failed command every 40 seconds until it works. Researchers say that is roughly what happened inside a UK school estate in September, and it ended with 37 machines encrypted.
The headline is AI. The lesson for small businesses is the old basics: protect your backups, limit your admin logins and put security software on everything.
What happened
Security firm Bitdefender describes an attacker linked to the 3AM ransomware group who spent about nine days, from 10 to 19 September, inside the network of a UK school estate. The victim isn't named, and Bitdefender couldn't work out how the attacker first got in. The environment had 47 systems, including about 21 servers.
The first recorded step was reading passwords stored on the estate's backup system. The attacker then created two hidden administrator accounts, linked three separate Windows domains together in roughly three hours, and copied out files from a finance share. On the last day they tried to remove the security software, which its tamper protection blocked, then encrypted about 37 machines and deleted system backups. Bitdefender's timeline shows the whole job took under ten days.
Where the AI comes in
Bitdefender's case rests on timing. When a command failed, the retry came back at steady gaps of 40 to 101 seconds, and a complete rewrite of a command arrived as quickly as a small edit. That looks like software, not someone typing.
Later, simpler steps were spaced 2 to 16 minutes apart, which looks more like a person reading the results. Bitdefender calls it a hybrid: a human sets the goals and an AI tool helps with the commands.
There is an important caveat. These are inferences from timing patterns. Bitdefender couldn't confirm whether an AI model ran the loop automatically or whether an operator was copying commands and results between a terminal and an AI tool. This was not a confirmed autonomous attack. Bitdefender says it is the first case of its kind it has documented in Europe.
What this means for UK small businesses
Your business isn't a school estate, but the shape is familiar: a few servers, a file share with finance data, a backup system, a handful of admin logins and security software of varying age.
The AI seems to have helped the attacker work faster and recover from mistakes. It didn't bring a new trick. Stolen stored passwords, new admin accounts and deleted backups are the standard ransomware playbook, so the standard defences are still the right ones.
What changes is the time you have to notice, which is another reason to get them in place before anyone is at the keyboard.
What to do this week
Treat your backups as a target. The attacker read backup passwords first and deleted backups last. Keep at least one copy that your everyday admin login can't change or delete, and check that a restore actually works.
Don't let one login open everything. Use separate admin accounts for separate systems, and don't store powerful credentials for several systems in one place. Bitdefender's advice is to keep admin accounts for different domains apart.
Put security software on every machine. That includes servers and old kit, and tamper protection should be switched on so a stolen admin login can't remove it. In this attack, tamper protection stopped that step.
Ask who would notice a new admin account. Put one question to your IT provider: if a new administrator account appeared at 3am, who would be told, and how fast? If the answer is "nobody until Monday", that is the gap to close.
Close the doors you can see from outside. Nobody found how this attacker got in, so the sensible move is to shut the usual routes: remote access left open to the internet, software with known flaws, and staff logins that have already leaked.
Sophia Says
The AI detail will get the attention, but I'd look at what the attacker went after: stored passwords, backups and admin accounts. Those are the oldest targets in ransomware. An attacker who works faster gives you less time to spot them, so the fixes need to be in place before anyone is at the keyboard.
HackRisk looks at your business the way an attacker would, then goes behind the perimeter too. We show you the doors open to the internet, the known flaws behind them and any staff logins that have turned up in leaks. Our internal vulnerability scans look for known flaws on the machines inside your network. The researchers couldn't say how this attacker got in, so the sensible move is fewer open doors outside and fewer known flaws inside.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
What's open to the internet: Recon Scan maps what your business has facing the internet, including remote access and admin pages you may not know are visible.
Known flaws: Vulnerability Scan checks your systems, outside and inside the network, for published weaknesses so you can chase a fix quickly. Internal scans use a small agent.
Leaked logins: Dark Web Scan watches for your business's accounts turning up in leaks, which attackers often use to get started.
Staff who question the odd request: Security Awareness Training helps your team spot the scams that start many attacks. Backups, admin accounts and security software on your own machines are for you and your IT provider to look after.
Close the doors you can see
Attackers are getting faster, but they still go through the same few doors. Get your free HackRisk report and see your business the way an attacker would.
Sources
Hackread, 3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack, 3 Nov 2026
