---
title: Hunt: a 3AM ransomware affiliate hit a UK school estate in what Bitdefender calls a part-human, part-agentic-loop intrusion: Veeam credential theft, rogue admins 'library' and 'svc_bkpmon', new two-way domain trusts | ctxsec
url: https://ctxsec.com/items/hunt-bitdefender-3am-hybrid-ai-ransomware-uk-school-veeam-domain-trusts
description: "Bitdefender says a 3AM (ThreeAM) affiliate worked a UK school estate from Sep 10 to 19, 2026, entirely from an unmanaged internal host, and encrypted about 37 of roughly 50 machines it reached. The commands look model-written (wrong Veeam REST port and auth, Unix idioms like 2>/dev/null in Windows commands, numbered script revisions, self-labeled output), and retries arrived every 40 to 101 seconds regardless of how much changed, which fits an agentic loop. Bitdefender stresses it is one case, the tooling was all public or built-in, and it can't rule out a person pasting between a shell and a chatbot."
status: "official (Bitdefender research, Nov 3). The AI involvement is Bitdefender's interpretation of command behavior; it says it could not see the attacker's machine or model"
published: 2026-11-03
---

> Bitdefender says a 3AM (ThreeAM) affiliate worked a UK school estate from Sep 10 to 19, 2026, entirely from an unmanaged internal host, and encrypted about 37 of roughly 50 machines it reached. The commands look model-written (wrong Veeam REST port and auth, Unix idioms like 2>/dev/null in Windows commands, numbered script revisions, self-labeled output), and retries arrived every 40 to 101 seconds regardless of how much changed, which fits an agentic loop. Bitdefender stresses it is one case, the tooling was all public or built-in, and it can't rule out a person pasting between a shell and a chatbot.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-bitdefender-3am-hybrid-ai-ransomware-uk-school-veeam-domain-trusts.md)

official (Bitdefender research, Nov 3). The AI involvement is Bitdefender's interpretation of command behavior; it says it could not see the attacker's machine or model

2026-11-03

### Hunt: a 3AM ransomware affiliate hit a UK school estate in what Bitdefender calls a part-human, part-agentic-loop intrusion: Veeam credential theft, rogue admins 'library' and 'svc_bkpmon', new two-way domain trusts

- **Backup first:** a modified `Veeam-Get-Creds.ps1` read and DPAPI-decrypted stored credentials on three Veeam servers via Impacket-style remote execution; a scheduled task named `VEEAMPROBE` was created on a backup server.
- **Credentials:** `reg save` of SECURITY and SYSTEM hives; Mimikatz renamed `sysmon64.exe`, `svcstat.exe` and random `.tmp.exe`; a comsvcs.dll MiniDump of LSASS; Chrome `Login Data` copied; portable Python 3.11 running `crackw.py` from `C:\Windows\Temp`.
- **Persistence:** domain admins `library` and `svc_bkpmon`, created by two different routes.
- **Unusual exfil:** files staged as base64 registry values (`HKLM\SOFTWARE\FIN001`…`FIN040`, `FINCOUNT`, `HKLM\SOFTWARE\VC31`), zipped and POSTed to `rcv.aspx` on the unmanaged host, with `alive HH:mm` heartbeats.
- **Spreading:** `dnscmd /zoneadd … /dsforwarder` then `netdom trust … /add /twoway` joined three separate AD domains; `grant_lib.ps1` pushed by scheduled task to about 40 machines; `av_remove.ps1`/`av_remove2.ps1` tried to strip Sophos and Bitdefender (blocked by anti-tamper).
- **Impact:** `host.exe -k <id> -s 15` with `wbadmin delete systemstatebackup -keepVersions:0 -quiet`.
- **Model-style artifacts worth alerting on:** files and tasks named `da_proof.txt`, `psexec-ok`, `TASK-OK`, `test123`, `step1.txt`…`step3.txt`; output like `===TRUSTS===` or `== CONNECTIVITY ==`; `2>/dev/null` inside cmd.exe lines; Impacket wmiexec output files `__<timestamp>` in ADMIN$.

Bitdefender publishes the full IoC set on its GitHub IoC repository. Its main point for defenders: an agentic loop makes an intrusion noisy and repetitive, not stealthy, so prevention controls that block an action the first time beat detections that rely on speed.

Sources: [Bitdefender: 3AM Hits European Schools: A Hybrid AI Ransomware Attack (Nov 3)](https://businessinsights.bitdefender.com/3am-ransomware-hybrid-ai-attack) · [BleepingComputer: UK school estate hit by 3AM ransomware in suspected AI-assisted attack](https://www.bleepingcomputer.com/news/security/uk-school-estate-hit-by-3am-ransomware-in-suspected-ai-assisted-attack/)