3AM Ransomware Affiliate Used an AI Agent Loop to Encrypt a UK School Network

Bitdefender has published a detailed investigation into a 3AM ransomware attack on a UK school estate in which the intruder appears to have handed much of the hands-on-keyboard work to an AI agent running in a loop. The report, released on November 3, 2026, describes a nine-day intrusion that ended with roughly 37 machines encrypted in under 30 minutes, and it lays out the technical fingerprints that led researchers to conclude an automated system was issuing many of the commands.

Bitdefender said its attribution of the attack to a 3AM affiliate is confirmed. The school estate has not been named, and Bitdefender has not said whether a ransom was demanded or paid. The case is notable less for the ransomware itself than for what it shows about how quickly a capable but sloppy AI-assisted operator can move through a Windows domain once inside.

The environment that was hit

The victim network contained 47 systems that Bitdefender analyzed, including about 21 servers and the rest Windows endpoints. Among the servers were 8 domain controllers, one of them still running Windows Server 2012 R2. About 10 workstations ran Windows 10 and the remainder ran Windows 11.

Bitdefender said the attacker operated from an unmanaged host inside the network, a machine with no endpoint protection installed. From that system, the operator reached about 50 machines over the course of the intrusion. How the attacker first got in remains unknown, and researchers flagged possible earlier activity on January 23, when Restricted Admin mode was enabled on a system, and again on June 5. The main campaign ran from September 10 to September 19, 2026.

Day by day: from backup servers to encryption

Bitdefender reconstructed the intrusion in detail. The key stages were:

• September 10 and 11: The attacker went after the backup infrastructure first, pulling stored credentials from 3 Veeam backup servers using a modified version of a public Veeam credential extraction script and Windows DPAPI decryption. Chrome saved password databases were also copied.
• Lateral movement: The operator used Impacket tools such as wmiexec and smbexec to run commands remotely. A copy of Mimikatz was renamed sysmon64.exe to blend in with legitimate monitoring software, an LSASS memory dump was attempted, and the SAM, SECURITY and SYSTEM registry hives were saved with reg save.
• September 14 and 15: Two new domain admin accounts were created as backdoors, with names chosen to look like ordinary library and backup monitoring service accounts.
• September 15: About 40 files from a finance share were staged inside registry values under HKLM\SOFTWARE, then sent out by HTTP POST to a web page hosted on the attacker’s unmanaged machine.
• September 18: The operator built two-way trusts across 3 domains using netdom and dnscmd, then pushed a script to about 40 machines to grant its accounts access.
• September 19: Repeated attempts to remove Sophos and Bitdefender endpoint agents with successive versions of a removal script were blocked by anti-tampering protection. Between 05:07 and 05:33 UTC, a Rust-based encryptor named host.exe encrypted about 37 machines and used wbadmin to delete Windows backups.

The data theft before encryption fits the double extortion model that 3AM affiliates have used since the group appeared, where stolen files give the attacker extra leverage even if the victim restores from backup.

Why researchers suspect an AI agent was driving

Bitdefender’s central finding is that the command history does not look like the work of a single human operator. Researchers pointed to several patterns that together suggest an AI model was generating and executing commands in an agentic loop, with a human steering at a higher level.

Machine-like timing. When a command failed, the next attempt typically came 40 to 101 seconds later, no matter how big or small the change was. Gaps between separate tasks were longer, from 2 to 16 minutes. A human fixing a one-character typo would usually retry faster than someone rewriting a whole script, but here the retry delay stayed consistent.

Confident but wrong documentation. At one point the operator tried to query the Veeam REST API on port 9392 with Basic authentication. Veeam’s documentation specifies port 9419 and OAuth2. Bitdefender said this kind of plausible but incorrect detail is typical of large language model output.

Linux habits on Windows. On 3 separate days, commands included Bash-style escaping of dollar signs, and some Windows commands ended with 2>/dev/null, a Unix redirect that has no meaning in the Windows command shell. A parsing bug in a for /f loop also passed a stray text fragment where an LSASS process ID was expected, breaking the memory dump attempt.

Self-checking artifacts. The intruder left behind small probe and confirmation files with names indicating a task had succeeded, proof of domain admin access or a successful Veeam probe, along with numbered script revisions. Bitdefender said this looks like an agent verifying its own progress step by step before moving on.

What Bitdefender is not claiming

The researchers were careful to limit their conclusions. Bitdefender said this is a single case and should not be read as a trend. It cannot identify which AI model was used, and it cannot rule out a human copying and pasting model output by hand. The company noted that AI-generated malware, sometimes called vibeware, still makes up only about 0.07% of the samples it sees.

Even so, Bitdefender expects hybrid attacks that pair a human operator with an AI agent to become more common in 2027. The same theme has shown up in other recent incidents, including our coverage of the Vapor Panda ARTEX AI agent espionage campaign and Chainalysis confirming a breach involving offensive agentic techniques.

Mapping the activity to attacker techniques

For defenders who track behavior against the MITRE ATT&CK framework, the intrusion touched a familiar set of techniques:

• Credential access: OS credential dumping from LSASS and registry hives, credentials from password stores in Chrome, and credentials pulled from backup software.
• Persistence and privilege escalation: creation of new domain accounts and modification of domain trusts.
• Defense evasion: masquerading a credential tool as a monitoring binary and attempting to disable security tools.
• Lateral movement and execution: remote services and Windows Management Instrumentation through Impacket.
• Exfiltration and impact: exfiltration over a web channel, data encrypted for impact and inhibiting system recovery by deleting backups.

Nothing on that list is new. What changed, according to Bitdefender, is the speed and persistence with which the operator cycled through failures until something worked.

Defensive lessons for schools and other flat networks

Bitdefender’s recommendations focus on the weak points the attacker leaned on. The most useful for education networks and other organizations with limited security staff include:

• Separate privileged accounts. Keep domain admin accounts separate from day-to-day accounts, and place any change to domain trusts under formal change control.
• Treat backups as a target. The attacker went after Veeam on day one. Keep immutable or offline backup copies and protect backup server credentials as carefully as domain admin credentials.
• Limit remote administration paths. Restrict WMI, remote registry, scheduled task creation and access to the ADMIN$ share to the systems and accounts that genuinely need them.
• Block interpreters where they are not needed. Machines that do not need PowerShell, Python or other scripting engines should not be able to run them.
• Close the unmanaged gap. The attack was staged from a host with no endpoint agent. Every machine on the network should be covered.
• Alert on high-signal events. New domain trusts, reg save of the SAM, SECURITY or SYSTEM hives, and unexpected probe files in system folders should all trigger an immediate investigation.

Bitdefender has published indicators of compromise for the case on its GitHub repository, which defenders can use to hunt for related activity.

The education sector keeps paying the price

Schools have been a steady target for ransomware crews and data thieves throughout 2026. BreachNews has covered incidents such as Evanston Township High School closing its campus after a confirmed ransomware attack and the Frontline Education breach affecting K-12 school districts. Many school networks share the conditions this attacker exploited: legacy domain controllers, flat internal networks, unmanaged devices and small IT teams.

The 3AM case suggests that an AI agent does not need to be elegant to succeed in that kind of environment. It only needs to keep trying, and in this intrusion it kept trying for nine days before encryption began.