The security boundary changed
Bitdefender’s November 3 investigation describes a September intrusion at a UK school estate in which a 3AM ransomware affiliate created two-way trusts between previously separate Active Directory domains. Researchers report roughly 37 encrypted machines after the attacker reached about 50 from an unmanaged host.
Observed intrusion, inferred automation
The report traces backup-credential theft, rogue administrator accounts and subsequent trust changes. Bitdefender interprets repetitive command revisions and retry timing as consistent with AI assistance. It could not inspect the attacker’s host, identify a model or exclude a person relaying commands manually. Initial access remains unknown. The report therefore supports a documented intrusion and a qualified automation hypothesis, not a finding that autonomous AI conducted the attack.
Why the trust change matters
MITRE’s ATT&CK framework treats malicious changes to domain and tenant trusts as a means of increasing access or evading defenses. Its mitigation guidance centers on limiting and protecting administrative authority over those relationships. That framing makes the school case relevant beyond the question of who authored the commands. Separate directories represent a useful security boundary only while changes to their relationships remain controlled. For school groups and their service providers, an incident review that inventories compromised computers but overlooks altered trust settings can miss how the environment’s access model changed. The recovery decision concerns the integrity of that model as well as the condition of individual files.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
