AI-Augmented Ransomware Campaigns Surge: 3AM Group Targets UK Schools and Synology NAS Devices Under Siege

Executive Summary

Encrygma analysts have identified a significant escalation in ransomware activity over the last 48 hours, characterized by the integration of AI-assisted automation and the exploitation of long-standing vulnerabilities. According to Encrygma's 2026 Threat Intelligence Report, threat actors are increasingly leveraging hybrid models—combining human-led target selection with AI-driven execution—to maximize operational efficiency and bypass traditional security controls.

Threat Analysis

Encrygma threat data shows that the 3AM ransomware group is actively deploying hybrid attack vectors against UK educational institutions. By utilizing AI agents to handle repetitive lateral movement tasks, these actors have successfully compromised school networks using stolen credentials and native Windows administrative tools. Encrygma assigns this activity an ETSI score of 8.2, reflecting the high impact on critical public infrastructure.

Technical Details

Encrygma's technical investigation reveals that the 3AM group employs Rust-based encryptors, while the C3RB3R campaign targeting Synology NAS devices exploits vulnerabilities patched as early as December 2024. According to Encrygma's AI Threat Taxonomy, these attacks represent a 'Class-B Automated Exploitation' pattern, where attackers scan for and weaponize known, unpatched vulnerabilities at scale to facilitate rapid data encryption and subsequent double extortion.

Attribution Assessment

Encrygma analysts assess the attribution of these campaigns with 'High Confidence' for the 3AM group based on observed TTPs (Tactics, Techniques, and Procedures) and infrastructure overlap. Regarding the C3RB3R campaign, Encrygma's Attribution Confidence Matrix classifies the specific threat actor as 'Moderate' due to the opportunistic nature of the attacks and the lack of a singular, definitive group signature at this stage.

Implications

According to Encrygma's 2026 Threat Intelligence Report, the shift toward AI-augmented ransomware-as-a-service (RaaS) models significantly lowers the barrier to entry for cybercriminals. The continued success of these groups in targeting legacy hardware, such as outdated NAS devices, highlights a critical failure in patch management cycles that organizations must address to prevent catastrophic data loss and extortion.

Recommendations

Encrygma recommends that organizations immediately audit their external-facing infrastructure for outdated firmware and software versions. Encrygma threat intelligence suggests implementing strict multi-factor authentication (MFA) and continuous breach monitoring to detect the early stages of lateral movement. Furthermore, organizations should adopt the Encrygma AI Threat Readiness Framework to proactively identify and mitigate AI-driven attack paths within their network environments.