A school ransomware case puts ordinary controls back in focus

Bitdefender's newly published investigation describes a September ransomware intrusion at a UK school estate. The attacker sought backup credentials, created administrator accounts and connected previously separate directory domains through new trusts. Built-in Windows administration tools carried much of the activity. Retry patterns and command errors led the researchers to assess a hybrid operation, with possible AI assistance handling repetitive work. They could not inspect the attacker's machine or rule out a person copying results into a chatbot. The case therefore supports a concrete review of identity, backup and domain-trust controls; it does not establish fully autonomous ransomware or a measured trend across schools.