# 3AM: Bitdefender reads an agentic loop in a school ransomware attack

> Bitdefender's analysis of a 3AM ransomware intrusion separates what its evidence supports from what it only suggests about AI.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Research
- **Published by:** Bitdefender
- **Disclosed:** 2026-11-03
- **Affects:** Windows, Active Directory, Veeam
- **Research by:** Marius Baciu
- **Primary source:** https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack
- **Page:** https://theinjection.dev/items/bitdefender-3am-hybrid-ai-ransomware/

Bitdefender says a 3AM ransomware affiliate that encrypted about 37 systems at a UK school estate ran part of the intrusion as an agentic loop, while stating it cannot rule out a person pasting commands between a shell and a chat window.

## What happened

Bitdefender published an analysis on 3 November 2026 of a 3AM ransomware affiliate's intrusion into a UK school estate of 47 systems, written by security researcher Marius Baciu. Hands-on activity ran from 10 to 19 September 2026 and ended with about 37 machines encrypted. Bitdefender calls the operation hybrid: parts look like a human operator at the keyboard, and parts look like a language model reading each result and choosing the next command.

## How it works

Built-in Windows tools did most of the work, joined by Mimikatz, an Impacket-style remote execution tool, a published Veeam credential script and a Rust-based ThreeAM encryptor. The attacker stole backup-server credentials, created two backdoor domain-admin accounts, then built two-way trusts across three previously separate Active Directory domains to reach other schools in the estate. Bitdefender's signals for model involvement include API mistakes typical of recalled rather than documented syntax, Unix habits inside Windows commands, output that labeled itself, numbered script revisions, and nine retries spaced a steady 40 to 101 seconds apart.

## Who is affected

Multi-domain Windows estates with shared administrative accounts and reachable backup servers match the conditions in this report. The estate held about 21 servers including eight domain controllers, ten Windows 10 workstations and one Windows Server 2012 R2 domain controller. Bitdefender notes that the host it believes drove any automation carried no endpoint agent and sat outside its visibility.

## What to do

Separate domain-admin accounts across domains, put trusts and admin accounts under change control, and alert on any new domain trust or netdom trust execution. Bitdefender also recommends isolating backup servers with per-domain accounts and immutable copies, limiting WMI, remote registry, scheduled-task creation and ADMIN$ access to known management hosts, blocking Python and PowerShell on workstations that never use them, and putting an endpoint agent on every machine.

## Quick facts

- **Victim:** A UK school estate, 47 systems
- **Encrypted:** About 37 machines, encryptor ran 05:07 to 05:33 on 19 September 2026
- **Hands-on window:** 10 to 19 September 2026, 60 distinct steps analyzed
- **AI evidence:** Bitdefender's working model, not established fact
- **Loop signal:** Nine retries spaced 40 to 101 seconds apart
- **Encryptor:** ThreeAM host.exe, Rust-based
- **Found by:** Marius Baciu, Bitdefender

## Questions

### Did Bitdefender confirm that an AI agent ran the 3AM attack?

Bitdefender confirmed nothing of the kind. The analysis separates three claims: that a language model wrote the commands, which Bitdefender calls strongly supported by their content; that an agentic loop chose each next action, which it says behaves like one but cannot be distinguished from a person copying between a shell and a chat window; and that no human was involved, which its own telemetry does not support.

### What made the commands look model-generated?

Several habits stood out to Bitdefender: Veeam API calls carrying mistakes typical of recalled rather than documented syntax, Unix-style conventions inside Windows commands, output that labeled itself, numbered script revisions, and retries at a steady 40 to 101 second cadence. Counter-signals included the conventional encryptor, the publicly available tooling, and the absence of self-narrating comments in bespoke payloads.

### How did the attacker reach other schools in the estate?

Domain trusts were the bridge. Bitdefender reports the environment began as several separate, unconnected Active Directory domains, and that on 18 September the attacker built two-way trusts across three of them between 15:39 and 18:37 UTC, then pushed access to about 40 machines. Searches of SYSVOL for other schools' names had preceded that step by several days.

## Sources

1. [Bitdefender Analysis](https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack)
2. [Indicators Of Compromise](https://github.com/bitdefender/malware-ioc/blob/master/2026_11-3am-iocs.csv)