3AM: Bitdefender reads an agentic loop in a school ransomware attack

01What happened

Bitdefender published an analysis on 3 November 2026 of a 3AM ransomware affiliate's intrusion into a UK school estate of 47 systems, written by security researcher Marius Baciu. Hands-on activity ran from 10 to 19 September 2026 and ended with about 37 machines encrypted. Bitdefender calls the operation hybrid: parts look like a human operator at the keyboard, and parts look like a language model reading each result and choosing the next command.

02How it works

Built-in Windows tools did most of the work, joined by Mimikatz, an Impacket-style remote execution tool, a published Veeam credential script and a Rust-based ThreeAM encryptor. The attacker stole backup-server credentials, created two backdoor domain-admin accounts, then built two-way trusts across three previously separate Active Directory domains to reach other schools in the estate. Bitdefender's signals for model involvement include API mistakes typical of recalled rather than documented syntax, Unix habits inside Windows commands, output that labeled itself, numbered script revisions, and nine retries spaced a steady 40 to 101 seconds apart.

03Who is affected

Multi-domain Windows estates with shared administrative accounts and reachable backup servers match the conditions in this report. The estate held about 21 servers including eight domain controllers, ten Windows 10 workstations and one Windows Server 2012 R2 domain controller. Bitdefender notes that the host it believes drove any automation carried no endpoint agent and sat outside its visibility.

04What to do

Separate domain-admin accounts across domains, put trusts and admin accounts under change control, and alert on any new domain trust or netdom trust execution. Bitdefender also recommends isolating backup servers with per-domain accounts and immutable copies, limiting WMI, remote registry, scheduled-task creation and ADMIN$ access to known management hosts, blocking Python and PowerShell on workstations that never use them, and putting an endpoint agent on every machine.

Questions people ask

Did Bitdefender confirm that an AI agent ran the 3AM attack?

Bitdefender confirmed nothing of the kind. The analysis separates three claims: that a language model wrote the commands, which Bitdefender calls strongly supported by their content; that an agentic loop chose each next action, which it says behaves like one but cannot be distinguished from a person copying between a shell and a chat window; and that no human was involved, which its own telemetry does not support.

What made the commands look model-generated?

Several habits stood out to Bitdefender: Veeam API calls carrying mistakes typical of recalled rather than documented syntax, Unix-style conventions inside Windows commands, output that labeled itself, numbered script revisions, and retries at a steady 40 to 101 second cadence. Counter-signals included the conventional encryptor, the publicly available tooling, and the absence of self-narrating comments in bespoke payloads.

How did the attacker reach other schools in the estate?

Domain trusts were the bridge. Bitdefender reports the environment began as several separate, unconnected Active Directory domains, and that on 18 September the attacker built two-way trusts across three of them between 15:39 and 18:37 UTC, then pushed access to about 40 machines. Searches of SYSVOL for other schools' names had preceded that step by several days.

Sources 2 links, all fetched

1. 1bitdefender.comBitdefender Analysis
2. 2github.comIndicators Of Compromise