The Loop That Replaced The Operator

When BleepingComputer reported that a UK school estate had been hit by 3AM ransomware in a suspected AI-assisted attack, the detail that mattered wasn't the ransom note or the encryption. It was the word "suspected," and what sat underneath it. Dark Reading's reporting on the same campaign described the affiliate using AI-like loops rather than a single operator working through a target manually. That's a different kind of attack, and it deserves a different kind of defensive argument than the one most organisations are currently making.

For years, ransomware operations have had a human bottleneck built in almost by accident. Someone has to decide which machine to move to next. Someone has to decide whether the backups found are real or decoys. Someone has to decide how long to wait before escalating pressure on a victim who has gone quiet. Those decisions took time, and that time was, in effect, free defensive runway. The 3AM affiliate's use of AI-like loops removes that runway. The decisions are still being made, but they are being made at machine speed, by something that doesn't need to sleep, doesn't get bored partway through a network, and doesn't wait for a boss to approve the next step.

What the loop actually replaces

It's worth being precise about what "AI-assisted" means in this context, because the phrase gets used loosely elsewhere. This isn't a chatbot writing phishing emails. Dark Reading's description of AI-like loops points to something closer to automated judgment: the attack tooling making the calls that a human operator used to make by hand, over and over, inside a single intrusion. Which credentials to try next. Which segment of a school network looks most valuable. When to pull the trigger on encryption rather than wait and see.

Judgment automation isn't unique to ransomware crews this year. Schneier on Security's coverage of AIs being used to find and exploit gaps in legal reasoning, under the heading "AIs Hacking the Law," describes the same underlying shift in a completely different domain: systems that used to require a trained human making case-by-case calls are being handed over to models that iterate faster than any person could. The school attacks are the security version of that same move. The judgment is the target, not just the network.

Defence is still built for the old clock

Most of what gets called "defence in depth" assumes the attacker is operating on something close to human time. Patch cycles are the clearest example. Android's November 2026 updates patched over 200 vulnerabilities in a single release. Red Hat issued a fix for a 9.8-rated Linux TCP remote code execution flaw, with Ubuntu following with its own patches for testing. Each of those is a serious, well-handled piece of security work. None of them happens at the speed of a loop deciding, mid-intrusion, what to do with the access it already has.

The Hacker News piece on exposure prioritisation makes the same point from the defender's side without naming the attacker problem directly: organisations are being told to operationalise four elements of prioritisation because they cannot patch everything at once, and they have to choose. That's a sound approach to a backlog. It is not an approach to an adversary that is choosing and acting in the same breath. A framework for weekly or monthly triage is a reasonable response to a slow-moving threat. It is not a reasonable response to a loop.

Why schools specifically

None of this would matter as much if schools were hard targets. They aren't, and the sector's exposure is already on the record independent of the 3AM campaign. The Frontline Education breach affected over 1.3 million people, a number that has nothing to do with AI tooling and everything to do with how education IT estates are resourced, staffed, and segmented. Schools sit in an unusual position: they hold sensitive records on children and families, they run on tight budgets, and their IT teams are frequently small and generalist rather than specialised in incident response. That combination made them a target before any loop existed. The loop just makes the existing weakness more expensive to have, because the window between initial access and full compromise is shorter than it used to be.

This is also why law enforcement wins, welcome as they are, don't change the calculus much. Russia's reported dismantling of the VasyGrek group's infrastructure and detention of three suspects, and the seizure of over 100 servers in an investment scam crackdown, are real disruptions. But they land after the fact, against infrastructure that's already been used. They don't touch the tooling gap that let an automated loop run inside a school network in the first place, and they don't touch the next affiliate who builds a similar loop from scratch.

The money is moving, slowly

The industry has noticed. CrowdStrike reportedly paying $495 million for Fiddler and Dreadnode is a straightforward signal that AI security tooling has stopped being a side project and started being core acquisition strategy for a major vendor. Google adding a $250,000 Cloud VRP reward specifically for root-in-cloud bugs points the same direction: the money is following the places where a single flaw gives an attacker the kind of broad, fast access a loop can exploit immediately rather than slowly.

But acquisitions take time to integrate, and bug bounty programmes take time to produce findings that get fixed. Both are the right moves. Neither is fast. A $495 million purchase announced this week does not protect a school network that gets hit next month, and a $250,000 reward for a root-in-cloud bug does not help an estate that's already running compromised infrastructure. The spending confirms the industry has recognised the problem. It does not mean the problem has been closed.

What "keeping up" would actually require

Other reporting this week shows the same pattern playing out across unrelated incidents. The critical Node-RED flaw being exploited in active attacks, and Russia-aligned Gorbag hackers using a WinRAR flaw to deploy data-stealing malware, are both cases of attackers moving on a disclosed or discovered weakness faster than the patching cycle around it. Russia-linked cyber spies targeting Ukraine's war crimes investigations and military aid routes shows the same tempo mismatch in an espionage context rather than a criminal one: the target moves and reacts in real time, the defensive posture updates on a slower schedule.

None of this means organisations should panic-buy AI defensive products to match AI attacker loops feature for feature. That's a vendor pitch, not a strategy. What it does mean is that the gap between "we patch monthly" and "the attacker's tooling makes a hundred decisions an hour inside our network" has to be named as the actual problem, rather than folded into a general conversation about AI threats. The 3AM affiliate's use of AI-like loops against a school estate is a specific, documented instance of judgment being automated inside an intrusion. Treating it as part of a vague trend rather than a concrete operational fact is exactly how defences keep being built for a clock that attackers have already stopped using.