decrypted · 3 november 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

A school estate's ransomware attack reads like an AI loop, and the lesson is old

Bitdefender has published the anatomy of a ransomware attack on a UK school estate that looks, in part, as though a machine was doing the typing. A 3AM ransomware affiliate encrypted about 37 of nearly 50 machines, and the interesting part is not the AI. It is how little the intruder needed that a well-run estate would not have handed over.

How the break-in worked

Initial access is unknown. Between 10 and 19 September the intruder ran a modified public script against three Veeam backup servers and decrypted the stored passwords. Backup software holds the keys to everything, so burglars look there first. Mimikatz, a well-known tool that lifts passwords out of a machine's memory, followed. Two backdoor domain administrator accounts, "library" and "svc_bkpmon", were created with names chosen to look like furniture. Finance files were staged and copied out before anything was encrypted.

Then the estate's history became its weakness. It began as several separate Active Directory domains, the Microsoft directory that decides who may log in to what. Bitdefender reports that the attacker joined three of them with two-way trusts, in effect cutting doors through the walls between separate buildings.

What the machine did

Bitdefender's evidence for AI help is oddly readable: a Veeam request sent to the wrong port and scripts numbered revision by revision. On 13 September four near-identical attempts arrived about 41, 49 and 47 seconds apart, each fixing the last error. Across nine retries the gap was 40 to 101 seconds whatever the size of the change. That looks like a loop: try, read the error, adjust, like a patient locksmith who never tires.

Bitdefender is careful, and so should we be. It could not reach the attacker's machine and cannot exclude a person pasting between a chat window and a shell. It calls this "one case, an anecdote, and not a trend".

What defenders would have seen

Every action came from an unmanaged host with no security agent. In the last stage the attacker tried to remove Sophos and Bitdefender protection, delete system-state backups and deploy a Rust-based encryptor. Each earlier step was a rare event on a quiet network: someone reading backup credentials, new domain admin accounts, new trusts between domains. Rare events make cheap alerts.

The Secure by Design lesson

Three design decisions would have changed this. First, backup credentials should not be decryptable by whoever lands on a server, and reading them should page someone. Second, joining domains together should need a second person's approval and raise an alarm, because a trust is a permanent door. Third, every machine needs an agent, or should not be on the network.

The cost is an afternoon of inventory and a handful of alert rules, not a new product. Speed was never the problem; time was. The question for your next governors' or board meeting is plain: who is told when a new domain administrator appears, and how fast?

Also this week

Barracuda. The vendor published fixes on 2 November for two flaws, CVE-2026-116606 and CVE-2026-111560, which together could give an attacker root on its appliances. The advisory scores them 9.3 and 8.6 and says both need administrative access. It does not mention exploitation in the wild. The command injection affects six product lines, including web application firewalls and load balancers, and devices several versions behind may need more than one update. Barracuda urges customers to restrict the admin interface to trusted internal networks and to turn on automatic patching. That is the lesson: an admin interface reachable only from inside should be the default, not advice.

ARTEX. CrowdStrike says a China-nexus group it tracks as Vapor Panda has used the ARTEX AI framework since 17 October against more than 200 organisations in at least 14 countries. Victims included foreign ministries and telecoms providers, with telecoms compromised in the US, Belgium and the Philippines. A human operator, giving instructions in Chinese according to recovered transcripts, directed the agents, and in one intrusion the planning agents consumed roughly 1.4 billion input tokens. Treat it as a sign of where tooling is heading, not a UK campaign.

Google Cloud. Google has added a $250,000 reward for "Root-in-Cloud" bugs, meaning full administrative control over arbitrary customer organisations with no prior access, stolen credentials or social engineering. Researchers must stop the moment they reach execution in Google's production infrastructure, and proof is by a designated test service account, never a real customer project. It is a reminder that tenant isolation is the promise UK customers of any hyperscaler are really buying, and the one they cannot inspect.

Sources

If your estate has the same blind spots, get in touch.