Bitdefender says 3AM affiliate may have used AI-like loops in UK school breach

On Nov. 3, 2026, Bitdefender said a 3AM affiliate had breached a UK school estate and might have used an AI-like agentic loop for repeated command tasks, with a human making high-level decisions.

Bitdefender described the hybrid human-AI reading as a model for planning by defenders rather than proof, and said it could not confirm which language model was involved or whether a person pasted results between the implant and the model. Bitdefender could not reach the unmanaged host used by the attacker, so it could not identify the model, where it was located, or whether automation or a person copied commands. “We were not able to access the machine the attacker worked from,” Bitdefender said.

Bitdefender said malicious activity took place between Sept. 10 and Sept. 19, 2026, but the vendor could not determine how the attacker first entered the network.

Bitdefender’s researchers described an agentic loop as “a program that feeds each result back to a model and runs what comes back.” Bitdefender said agentic loops create noise by leaving repeated commands, small adjustments, numbered scripts and probe files, and even the quickest retries required at least 40 seconds.

The time between retries during the intrusion ran from 40 to 101 seconds. Switching to a completely different task required between two and 16 minutes during the intrusion.

On Sept. 13, 2026, the attacker ran a PowerShell command, then repeated it unchanged after 41 seconds, changed one call 49 seconds later, and switched to wmic 47 seconds after that. A full PowerShell rewrite appeared as quickly as earlier minor changes, following nine retries.

Commands showed signs of model generation, including a Veeam (backup software) API call using port 9392 and basic login rather than the documented port 9419 and security token, plus confirmation files, self-labeled output, and numbered script revisions. Escape characters from Bash appeared inside Windows commands on three separate days, and the actor left test files including psexec-ok and da_proof.txt along with numbered scripts av_remove, av_remove2 and av_remove3. The attacker used Unix-style syntax inside Windows commands during the intrusion.

The school estate included 47 systems, with approximately 21 servers and eight domain controllers, 10 Windows 10 workstations, one Windows Server 2012 R2 domain controller, and the rest running Windows 11. The 10 Windows 10 workstations ran an operating system that left support in October 2025.

The attacker used a modified public PowerShell tool to extract and decrypt backup credentials from three Veeam servers on Sept. 10 and 11, 2026. The tool, named Veeam-Get-Creds.ps1, read credentials and decrypted them using DPAPI. The initial credential-theft command ran through WMI, while the following two ran as services with services.exe as the parent process. Backup credentials could give privileged access to production systems and recovery infrastructure.

The attacker took a Chrome Login Data file from a terminal server and ran Mimikatz and LSASS memory-dumping tools, including one renamed to sysmon64.exe. An attempt to dump LSASS memory was made, but the result is unknown. Forensics observed SAM and SECURITY hives dumped over the winreg named pipe and found Mimikatz as svcstat.exe and in a buzzypdf folder.

The attacker examined domain trust relationships and searched SYSVOL logon-script folders for names and subnets of other schools. On a domain controller, the attacker counted non-system service accounts and listed domain trusts using nltest /domain_trusts. Domain trusts can let authenticated users and administrators reach resources across organisational boundaries depending on permissions.

From Sept. 13 onward, commands redirected output to timestamped files in the hidden ADMIN$ share, which matches Impacket’s wmiexec module.

The attacker set up two-way trusts between three previously separate Active Directory domains on Sept. 18, 2026, using netdom and dnscmd, work that required about three hours. After building domain trusts, the attacker ran diagnostic probes and restarted the service that maintains the secure channel between domains.

The attacker extended access for its backdoor account to roughly 40 machines after setting up domain trusts. The attacker made two backdoor domain administrator accounts named library and svc_bkpmon on Sept. 14 and 15, 2026. The two accounts came into being through separate routes, one through the school-management backup job and one over WinRM.

The attacker put 40 finance files through the Windows registry and sent them to an attacker-controlled endpoint on Sept. 15, 2026. Forty finance files went into registry values, were copied with robocopy, zipped, and sent to rcv.aspx on the unmanaged host C2 endpoint. Regular alive HH:mm status messages went to the same C2 endpoint.

On Sept. 19, 2026, the attacker attempted to remove Sophos and Bitdefender protection, but anti-tampering controls blocked the attempt. Next, the attacker deployed the Rust-based 3AM encryptor.

The encryptor successfully locked roughly 37 of nearly 50 reachable machines on Sept. 19, 2026, and removed Windows system-state backups. Those encrypted machines could be reached from one unmanaged internal host.

The encryptor operated from 05:07 to 05:33 UTC at about 12 to 13 seconds per machine, striking roughly 37 machines in 26 minutes beginning just after 5 a.m. UTC.

The 3AM encryptor is Rust-based, launched as host.exe with an ID argument and speed argument, includes an anti-debugging check, and removes Windows system-state backups. The 3AM encryptor attempts to shut down security and backup services before encrypting files and tags them with .threeamtime.

Bitdefender said the intrusion came from a confirmed 3AM affiliate. Bitdefender said this is the first case of this kind it has investigated in Europe, though one case is an anecdote rather than a trend. Bitdefender said most of what its MDR team observes in real-world investigations stays boring and still looks like pre-language-model intrusions.

Bitdefender expects hybrid attacks like this will become more common in 2027.

AI-generated malware called vibeware makes up roughly 0.07 percent of the malware samples Bitdefender gathers monthly. Bitdefender’s June 2025 study of roughly 700,000 incidents found that 84 percent of high-severity attacks relied on living-off-the-land binaries. Bitdefender’s analysis of roughly 700,000 incidents found that four of the five most abused binaries, netsh, PowerShell, reg and rundll32, appear in this attack. Bitdefender said an AI-enabled attack does not need to be novel or creative and uses techniques defenders already understand.

Public tracking lists ThreeAM as first seen in February 2023, and the cartel gained wider attention in September 2023 when Symantec observed an affiliate move to it after a LockBit deployment was stopped. ThreeAM runs as ransomware-as-a-service, with the core operation building the encryptor and leasing it to affiliates. Researchers later connected ThreeAM to the Conti and Royal ransomware cartels.

ThreeAM affiliates have been seen using e-mail bombing and spoofed IT support calls to enter corporate networks. A notable earlier victim is Kootenai Health, where an August 2024 attack exposed personal information for more than 464,000 patients. ThreeAM usually relies on double extortion, stealing data and threatening to publish it unless victims pay, according to Blackpoint Cyber.

Bitdefender said threat actors seem to be testing AI tools extensively regardless of current involvement in ThreeAM attacks. Martin Zugec, technical solutions director at Bitdefender, said “a hybrid model is more reasonable for financially motivated cybercriminals, technically and economically, than a fully autonomous attack.”

Bitdefender advises separating administrator credentials across domains, treating backups as targets, restricting remote execution and administrative shares, blocking unused interpreters, installing endpoint agents everywhere, and alerting on new domain trusts. Bitdefender said controls should function regardless of volume and speed because they halt an action the first time and the hundredth.

The UK NCSC released The State of the Cyber Nation on Nov. 3, 2026, calling on critical infrastructure to prepare for AI-powered ransomware attacks by 2028.

As of Nov. 3, 2026, the school estate had not been named publicly and no related leak-site listing had surfaced. No attacker IP addresses, domains or malware hashes were accessible to the public as of Nov. 3, 2026.

Two earlier events might or might not connect to the intrusion: Restricted Admin mode turned on for four machines on Jan. 23, 2026, and an interactive session typed by hand on June 5, 2026. Bitdefender classified the January and June events as unconfirmed earlier activity outside the September timeline.

Investigators did not identify an affected Veeam software version, and they did not tie the incident to a new Veeam vulnerability. The .threeamtime extension and Volume Shadow Copy deletion link to ThreeAM, but the attack’s extension was not revealed.