A ransomware affiliate has targeted UK schools with a blend of human infiltration and AI-like automation. Researchers at Bitdefender identified a malware operation involving a hybrid approach: a person sets the objectives, while a language model handles repetitive tasks like retrying failed commands. It deleted system-state backups as it progressed.
Indicators of compromise (IoCs): - Type: Host.exe (-k victim ID, -s 15) - ThreeAM Rust-based encryptor - Account: Library - Backdoor domain admin - Account: Service - Backdoor domain admin - Tool: Sysmon64.exe (Mimikatz masquerading) - Tool: ServiceStat.exe (Mimikatz copy) - Script: Veeam-Get-Creds.ps1 - Modified public tool for backup credentials - Scripts: av_remove.ps1, av_remove2.ps1, av_remove3.ps1 - EDR removal attempts - Scripts: grant_lib.ps1, hop2.ps1, hop3.ps1, crackw.py - Access push, hopping, Python script - Files: da_proof.txt, psx_mark.txt, step1.txt, step2.txt, step3.txt - Probe and log files - Scheduled Task: VEEAMPROBE - Task created on backup server - Batch Files: diag_member.bat, diag_nl.bat, lmhosts_test.bat, wb_probe.bat, nl_restart.bat - Trust build diagnostics - Registry: HKLM\SOFTWARE\VC31, FIN001 to FIN040, FINCOUNT - Registry used for data transfer - URL Path: rcv.aspx (f=fin.zip, f=status.txt) - Exfiltration endpoint - Command: wbadmin delete systemstatebackup - Backup deletion - Download: mimikatz_trunk.zip, version 2.2.0-20220919 - Public GitHub release - Path: C:\Windows\Temp - Staging folder For rapid incident containment, ensure SOC alerts are fed into controlled threat intelligence platforms like MISP, VirusTotal, or your SIEM.
