What happened

The attacker reached across school boundaries

Bitdefender investigated a 3AM ransomware intrusion in a UK school estate during September. It could not establish the initial access method. From an unmanaged host, the attacker used familiar Windows tools and public utilities to move through the environment. The investigation documents credential extraction from Veeam backup servers, browser credential collection, new domain administrator accounts and two-way trusts between previously separate Active Directory domains.

The attacker then tried to remove endpoint protection and system-state backups before deploying the encryptor. Bitdefender reports that encryption succeeded on roughly 37 of the 47 systems in its machine list. These are concrete, reviewable actions. The incident is not best understood by the AI label alone.

The AI question

A plausible reading, not a proven toolchain

Bitdefender observed repeated command attempts arriving at a fairly steady pace even when the revisions differed in size. Its researchers assess that part of the intrusion behaved like an agentic loop, with a person setting goals and automation handling retries. They could not inspect the attacker's working machine or identify a model. A person copying commands between a chat tool and a shell remains possible.

Keep the evidence separate

The intrusion, credential theft, trust changes and ransomware deployment are documented. The precise role of AI is an informed assessment. Do not turn this one case into a claim that ransomware is generally autonomous.

Defender workflow

Watch the transitions that made the attack spread

  1. 1

    Review backup-server access. Investigate unexpected reads of stored backup credentials, unusual remote execution and access from machines outside normal management coverage.

  2. 2

    Alert on new trust relationships. Require a change record for new two-way domain trusts, especially between school or business-unit domains that were previously separate.

  3. 3

    Trace privileged account changes. Review newly created administrators, cross-domain logons, protection changes and backup deletion attempts together. Each event is more meaningful in the same timeline.

Defender note

The detection opportunity was ordinary

This case is a reminder to keep domain controllers, backup servers and management hosts in the same investigation view. The attacker's tools were familiar; the unusual part was how quickly access to one part of the estate became access to another. That transition is where defenders can set a useful tripwire, regardless of whether an AI system helped write the commands.