3AM Ransomware: Signs of AI Assistance, AD Trust Changes, and Around 37 Systems Encrypted

1. Overview

• Title: 3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop
• Source: Bitdefender
• Published Date: 2026-11-03
• Original: Bitdefender
• Related Sources: BleepingComputer: UK school estate hit by 3AM ransomware
• Related Malware: 3AM ransomware, Mimikatz
• Related Threat Groups: 3AM affiliate
• Related CVEs: None specified
• Related Products: Active Directory, Veeam, Windows, PowerShell, WMI, WinRM
• Severity: Critical

2. Summary

Bitdefender reported that a 3AM affiliate compromised a UK school network, involving credential theft, the creation of backdoor Domain Admins, the staging and exfiltration of financial data to a C2 server on an unmanaged host, and the configuration of a two-way trust across three Active Directory domains before encrypting approximately 37 systems. The command syntax and error patterns strongly suggest generation by an LLM, and the retry intervals resemble an agentic loop. However, manual human copy-and-paste cannot be ruled out, meaning this cannot be definitively classified as a fully autonomous AI attack.

Confirmed activities in the environment include credential theft, domain admin persistence, cross-domain access, data exfiltration, and ransomware encryption. While AI involvement is a strong analytical assessment, the attack was executed using traditional attack tools and Living off the Land techniques. Therefore, this single case should not be generalized as an industry-wide AI attack trend.

3. Attack Flow

From Credential Theft to Cross-Domain Encryption

1. Initial Exploration: The initial access vector remains unidentified. The attacker used an internal, unmanaged host lacking monitoring agents as a foothold, enumerating the network via PowerShell, WMI, SMB, WinRM, and public tools.
2. Credential Theft and Privilege Persistence: The attacker extracted credentials from Veeam databases, copied saved Chrome data and registry hives, ran Mimikatz, and attempted an LSASS dump whose outcome is unknown. Two backdoor Domain Admin accounts, library and svc_bkpmon, were created through separate routes.
3. Data Exfiltration: On September 15, data from financial shared folders was staged into registry values and archives, then exfiltrated via HTTP POST to a C2 endpoint (rcv.aspx) on an unmanaged host.
4. Domain Trust Manipulation: On September 18, using information obtained from SYSVOL, the attacker executed commands to configure a two-way trust between three independent domains, granting backdoor account access to approximately 40 machines (since trust creation itself does not directly assign permissions, separate access control configurations were applied).
5. Encryption Deployment: On September 19, attempts to stop and uninstall EDR were blocked by tamper protection. The attacker nevertheless used scheduled tasks to distribute the loader and 3AM encryptor, encrypted approximately 37 systems, and used wbadmin to delete system-state backups.

4. Attacker Location and Execution Context

• Observed attacker actions were executed from an internal, unmanaged host where Bitdefender agents were not deployed. While automated scripts may have been running on this host, the complete picture could not be confirmed due to a lack of monitoring.

5. Victim and Administrator Perspective

Victims

• Across multiple schools, impact surfaced as inaccessible shared files, system outages, and the display of ransom notes.

Administrators

• Observed indicators include access to Veeam credentials, saving of registry hives, Mimikatz execution artifacts, remote execution via WinRM/SMB/WMI, the creation of suspicious new Domain Admins, domain trust modifications, scheduled task creation, backup deletion via wbadmin, and the rapid mass encryption of multiple terminals.

6. Success and Failure Conditions

Success Conditions

• The attacker can reach multiple servers from an internal unmanaged host and obtain backup and domain credentials.
• Acquired accounts possess Domain Admin privileges, trust creation rights, remote execution rights, and scheduled task creation rights.
• Even if EDR deletion attempts are blocked, no multi-layered defense controls exist to block the execution of encryption tools or backup deletion.

Failure Conditions and Mitigations

7. What Happens Upon Success

• Theft of domain credentials and exfiltration of financial data to a C2 server on an unmanaged host.
• Privilege escalation across three domains and persistence established via backdoor Domain Admin accounts.
• Encryption of approximately 37 endpoints and servers, along with the deletion of system state backups (systemstatebackup).

8. Observable Logs

Inference: The following is a summary of log candidates that organizations should investigate. This depends on log collection and retention settings and does not imply that all logs were verified in the primary source.

• Email: The initial access vector was not identified. Without assuming phishing, review suspicious emails and business communication messages during the timeframe as a secondary check.
• Proxy / SWG / DNS: Downloads of Mimikatz or portable Python, HTTP POST traffic to rcv.aspx on an unmanaged host, and communications to unknown external C2 servers.
• Endpoint / EDR: Abnormal launches of PowerShell, WMI, reg, netsh, rundll32, renamed executions of Mimikatz, saving SECURITY/SYSTEM hives, LSASS dumps, execution of wbadmin, and numbered script naming conventions (.ps1/.cmd).
• Identity / IdP: Creation of library or svc_bkpmon accounts, addition to the Domain Admins group, WinRM/SMB logons, abnormal usage of service accounts, and domain trust modification events.
• SaaS / Cloud: Veeam audit logs, changes to backup job execution contexts, and security product policy modification histories.
• Network: Internal burst traffic on SMB (445), RDP (3389), and WinRM (5985), cross-domain DNS/traffic, and fan-out traffic directed at approximately 40 machines at 101-second intervals.

9. Attack Success Determination

Data or Session Compromise Confirmed

• Determination Stage: Data or session compromise confirmed (data_or_session_compromise) / Scope: Multiple domains in a UK school network.
• Basis: Bitdefender confirmed credential collection, the staging of financial data, and HTTP POST transmission to a C2 server on an unmanaged host.

Follow-on Compromise Confirmed

• Determination Stage: Follow-on compromise confirmed (follow_on_compromise) / Scope: UK school network.
• Basis: Bitdefender reported the creation of two backdoor Domain Admins, trust configuration operations across three domains, and 3AM encryption and backup deletion across approximately 37 systems. The assessment that trust relationships functioned effectively is inferred from the success of cross-domain encryption.

10. Investigation Playbook

Inference: The following is the incident investigation procedure for organizations.

Trigger

• Initiated by alerts for unauthorized Domain Admin account creation, domain trust configuration changes, Veeam credential extraction, short-cycle (40 to 101 seconds) command retries, and simultaneous encryption alerts across multiple hosts.

Initial Verification

• Establish a timeline for the activity start time of unmanaged hosts, new account creation, domain trust modifications, remote command execution, and encryption start times.

Endpoint

• Preserve memory, registry hives, process logs, scheduled tasks, scripts, and archive files from domain controllers, Veeam servers, unmanaged hosts, and file servers.

Identity / Cloud

• Review Active Directory accounts, group memberships, trust relationship modification histories, service account behavior, WinRM/SMB logons, and backup credential usage status.

Follow-on Compromise

• Track destinations for exfiltrated financial data, lateral spread to other domains, persistent callback communications, additional encryption tools, and the reuse of stolen credentials.

Containment

• Isolate unmanaged hosts and affected segments from the network, disable backdoor accounts and unauthorized trust relationships, perform a full rotation of privileged credentials, and block remote management protocols.

Determination

• Isolate and verify each phase: initial access, credential theft, Domain Admin creation, trust modification, data exfiltration, and encryption.

11. Defense and Detection Ideas

Single Event Detection

• Detect the execution of netdom trust /add /twoway, addition of new Domain Admins, reg save, and wbadmin delete systemstatebackup as high-priority alerts.

Time-Series Correlation

• Perform time-series correlation analysis on Veeam credential access, Domain Admin creation, domain trust modifications, mass deployment of scheduled tasks, and the launching of encryption tools.

Hunting Perspective

• Search for strings such as library, svc_bkpmon, VEEAMPROBE, da_proof, and psexec-ok, numbered script naming conventions, and command retry logs repeated at 40 to 101-second intervals.

Blind Spots in Log Design

• If EDR is not deployed on internal unmanaged hosts, directly identifying AI automation tools or the origin of the attacker's command generation becomes difficult.

Priority Mitigations

• Prioritize comprehensive endpoint management (eliminating unmanaged devices), a tiered administrator model, monitoring domain trust modifications, complete separation of backup permissions, enabling EDR tampering protection, and operating immutable backups.

12. Facts / Inference / Hypothesis

Facts

• Bitdefender attributed the activity to a 3AM affiliate and observed activity across a UK school network between September 10 and September 19, 2026. The initial access vector was not identified.
• The attacker collected credentials by combining a modified Veeam credential extraction script, saved Chrome data, Mimikatz, registry hive saving, and attempted LSASS dumps.
• Two backdoor Domain Admin accounts, library and svc_bkpmon, were created via separate paths.
• The attacker executed commands to establish a two-way trust relationship among three independent Active Directory domains, separately distributing backdoor account access rights to approximately 40 devices. Trust configuration itself does not directly assign privileges. Investigation logs contain no probe output, and the success or failure of the initial trust configuration attempt remains unconfirmed.
• Commands staging files from financial shared folders into registry values and archives, followed by HTTP POST transmission to rcv.aspx on an unmanaged host, were observed.
• EDR deletion attempts were blocked by tampering protection, but the 3AM encryption tool encrypted approximately 37 systems and used wbadmin to delete system state backups.
• Identical commands were repeatedly re-executed with minor corrections and tool switches at fixed intervals of 40 to 101 seconds. The commands contained incorrect Veeam API usage, validation files, self-labels, and numbered revision notations.
• Bitdefender assesses LLM-generated commands as strongly supported, but treats an agentic loop as a working model rather than an established fact. Human copy-and-paste cannot be excluded, and the claim that no human was involved in the hands-on phase is unsupported.

Inference

• Inference: The intervals between tasks were several minutes, and retry intervals ranged from 40 to 101 seconds. This is consistent with a hybrid operation where a human sets goals and a model handles mechanical retries. However, these logs could also be explained by the use of a slow-responding model or iterative manual human operations.
• Inference: The fact that encryption occurred across domains following the execution of trust configuration commands suggests that the trust relationships functioned. However, because probe results were not recorded, the exact timing of when the initial configuration command succeeded cannot be determined.

Hypothesis

No additional hypotheses. Unverified items are documented in Unknowns and Limitations.

13. MITRE ATT&CK Mapping

14. Unknowns and Limitations

• The initial access vector, intrusion method for unmanaged hosts, type of LLM used, execution environment, and details of automation code are unknown.
• Whether a truly autonomous agentic loop existed or whether humans manually copied and pasted prompts between models cannot be determined from log evidence alone.
• Aside from the approximately 37 encrypted systems out of roughly 50 reachable devices, the broader impact, ultimate misuse of exfiltrated data, and ransom demand/payment status have not been publicly disclosed.
• Records are limited to detected events; if unrecorded attempts exist, the observed 40 to 101-second interval represents the upper bound of retry durations.

15. Impact on SOCs and Organizations

Educational institutions, local authorities, and organizations operating multiple Active Directory domains should incorporate the execution of netdom trust commands, the addition of new Domain Admin accounts, suspicious access to backup servers such as Veeam, and mechanical retries via numbered scripts at 40 to 100-second intervals into their monitoring systems as high-priority alerts. Regardless of whether AI tools are used, the core of the attack relies on Living off the Land techniques, acquisition of privileged accounts, and a chain of unauthorized domain trust manipulations. Implementing multi-layered defenses to sever these paths early is essential.

16. Summary by Role

• SOC: Correlate netdom trust execution, Domain Admin creation, Veeam credential access, and repeated commands at short intervals.
• Administrators: Eliminate unmanaged hosts, completely separate backup server privileges from Domain Admins, and enable EDR tampering protection.
• Users: If you notice encrypted shared files or ransom notes, immediately disconnect your device from the network and report to administrators.