3AM Ransomware at a UK School Estate: Bitdefender Sees a Human-Plus-Agentic-Loop Intrusion

Bitdefender says a 3AM (ThreeAM) ransomware affiliate breached a UK school estate in September 2026 using commands that behave like an agentic loop: a language model reading each result and retrying with different commands. Around 37 of the roughly 50 machines the attacker reached from an unmanaged host were encrypted. Bitdefender calls it a hybrid operation, part human, part loop, and is careful to say it is one case, not a trend. The research was published on November 3, 2026 (Bitdefender Labs; BleepingComputer summary).

If you run AI coding agents, you are not the victim here. The relevance is the mechanism: this is what an agent with a shell looks like from the defender's side, and it shows which parts of an intrusion a model is good at.

TL;DR

What happened, in order

The malicious activity ran from September 10 to 19, 2026, according to Bitdefender. Every attacker action it saw originated from an unmanaged host, an internal machine with no Bitdefender agent, which is also why the researchers could not inspect whatever automation drove the commands.

1. September 10 to 11: backup credentials. A modified copy of a public script, Veeam-Get-Creds.ps1, read credentials from Veeam databases on three backup servers and decrypted them with DPAPI. Delivery used Impacket-style remote execution. A Chrome Login Data file was copied from a terminal server.
2. September 12 to 13: reconnaissance. A probe tested ports 445, 3389 and 5985 on four targets, tried to add a Defender exclusion for C:\Windows\Temp and downloaded Mimikatz from its public GitHub release. On a domain controller the attacker listed Domain Admins and Enterprise Admins into a file named da_proof.txt, enumerated trusts with nltest and searched SYSVOL for the names and subnets of other schools.
3. September 14: credential dumping and backdoors. The SECURITY and SYSTEM hives were saved with reg save, Mimikatz ran renamed as sysmon64.exe, and an LSASS dump was attempted. Two backdoor domain-admin accounts, named library and svc_bkpmon to blend into a school account list, were created by two separate routes.
4. September 15: staging and exfiltration. Forty files from a finance share were staged into registry values under HKLM\SOFTWARE, copied by robocopy, zipped and POSTed to a page named rcv.aspx on the unmanaged host. Bitdefender calls registry-as-transport an unusual choice and a good thing to hunt for.
5. September 18: domain trusts. In roughly three hours the attacker built two-way trusts between three separate domains with netdom and dnscmd, ran diagnostic probes, restarted Netlogon, then pushed a script by scheduled task to about 40 machines to grant the backdoor account access.
6. September 19: loader and encryption. An EDR removal script (av_remove.ps1, then av_remove2.ps1 seven minutes later) was blocked by anti-tampering. A loader was developed on one workstation, then deployed to about 40 machines at about 101 seconds each. The 3AM encryptor ran from 05:07 to 05:33, 12 to 13 seconds per machine, deleting system-state backups with wbadmin.

Bitdefender also notes two earlier events of unconfirmed relationship (Restricted Admin mode enabled on four machines on January 23, 2026, and a hand-typed interactive session on June 5) and does not fold them into the September timeline.

Why Bitdefender thinks a model was in the loop

Bitdefender separates three claims and rates each differently, which is the most useful part of the report. A language model generated the commands: strongly supported. An agentic loop chose each next action: behaves like one. No human involved in the hands-on phase: unsupported.

The retry cadence

The clearest example is a retry sequence on a domain controller on September 13. The attacker ran a PowerShell command, re-ran it byte-identical 41 seconds later, changed only the final call 49 seconds after that, and 47 seconds later abandoned PowerShell for wmic. Across nine retries, the delay before the next attempt ran from 40 to 101 seconds regardless of how big the change was. Moving on to a new task took minutes; on September 13 the gaps between tasks were 5, 2, 14, 16 and 3 minutes. Short gaps for retries and long gaps for decisions is what you would see if a person chooses the goal and a model handles the repetition.

Mistakes of a writer working from memory

• A call to Veeam's web interface used port 9392 with HTTP Basic authentication, where Veeam's REST documentation uses port 9419 and an OAuth2 token. Right shape, wrong specifics.
• An LSASS one-liner used for /f "tokens=2" over CSV output without delims=",", so rundll32 received K" as the process ID.
• Bash-style \$ escapes appeared inside Windows PowerShell on three separate days, and three commands used 2>/dev/null in a 51-minute window on September 13.
• Probe-and-confirm habits: test strings and files such as test123, TASK-OK, psexec-ok, a task literally named VEEAMPROBE, and output labeled inline with ===TRUSTS===.
• Numbered revisions that leave a new file instead of editing the old one: dcboot and dcboot2, av_remove through av_remove3, prx through prx3.

What cuts the other way

Bitdefender lists the counter-evidence itself. The encryptor is a conventional commodity binary. There are no natural-language comments or reasoning text in any bespoke payload, which was a main line of evidence in an earlier case it cites. No hands-on decision cycle was faster than about 40 to 60 seconds, and the fast segments (101 seconds and 12 to 13 seconds per machine) are scheduled fan-outs, which are deterministic loops, not decisions. Command length splits into two styles (median 365 to 493 characters on some days, 46 to 86 on others), which shows two authoring styles, not necessarily two authors.

Its own reading, labeled as interpretation: domain-trust building is repetitive, order-sensitive configuration where the fix comes from reading an error and trying again, which suits a model.

Claimed versus verified

I have not inspected the telemetry myself; this table reflects Bitdefender's own assessments and its published indicator set on GitHub and IntelliZone.

What this means if you run AI coding agents

An agent loop that reads output and retries is exactly what many of us run daily, just pointed at a different goal. Three practical takeaways:

• Repetition is the fingerprint. Bitdefender's own conclusion is that a loop does not make an intrusion quiet or subtle, it makes it repetitive. The same applies to your agents: a rerun-tweak-switch-tool pattern in an agent's shell history is normal when it debugs, and a red flag when it happens against ~/.ssh, cloud credentials or backup configs.
• Keep privileged credentials out of reach. The intrusion started with credentials taken from backup software. Anything a coding agent can read from your home directory or environment, a hijacked or prompt-injected agent can use. See how API keys leak in logs and env vars.
• Treat backups and domain-level admin as separate trust zones. Bitdefender's recommendations apply directly if you administer a Windows estate: separate administrative accounts per domain, change control and alerts for every new domain trust (netdom trust), isolated backup servers with immutable copies no domain account can delete, restricted WMI, remote registry and ADMIN$, interpreters blocked where unused, and an endpoint agent on every machine. The staging host here was unmanaged, which is exactly why nobody can say what drove it.

Bitdefender's suggested hunts are cheap: credential-reading access to backup databases, reg save of SECURITY, SYSTEM or SAM by anything other than a known job, files or tasks named like test123, psexec-ok, da_proof or VEEAMPROBE, and scripts that write numbered self-logging output.

What developers and defenders can take from the pattern

This is another recent report where criminals add a model to a normal playbook rather than invent a new one. Sophos described Aur0ra operators using Cursor agents to reach domain admin, Wiz mapped the anatomy of an AI-driven cloud attack, and the October roundup of AI-led attacks shows the same shape: familiar techniques, faster retries, more noise. Bitdefender stresses this is a single case, and that vibeware accounts for only about 0.07% of the malware samples it collects monthly.

The honest conclusion is the one Bitdefender states: nothing new worked here, so the old controls work. What changes is what the traces look like. Prevent rather than race: controls that stop an action the first time and the hundredth beat detection that depends on spotting enough events quickly.

Frequently asked questions

What did Bitdefender find in the 3AM ransomware attack on a UK school estate?

Bitdefender investigated a 3AM (ThreeAM) affiliate intrusion between September 10 and 19, 2026 and calls it a hybrid operation: some steps show a human at the keyboard, others behave like an agentic loop in which a language model reads each result and retries with different commands. Roughly 37 of about 50 reached machines were encrypted.

Is it confirmed that an AI ran the attack?

No. Bitdefender could not access the attacker machine, so it cannot say which model was used, whether it ran locally or remotely, or whether a person copied results between a shell and a chat window. It rates model-written commands as strongly supported, an agentic loop as behaving like one, and a fully human-free hands-on phase as unsupported.

Which tools did the attacker use?

Almost entirely built-in Windows tools (PowerShell, WMI, reg, netsh, rundll32, netdom, nltest) plus public ones: an Impacket-style remote execution tool, Mimikatz, a published Veeam credential script and a commodity Rust-based 3AM encryptor. Bitdefender found nothing novel.

How can defenders spot an agentic loop in logs?

Look for repetition: the same command re-run unchanged, then tweaked, then replaced by another tool, retries at steady 40 to 101 second intervals, numbered script revisions such as av_remove, av_remove2 and av_remove3, and probe or confirmation artifacts like da_proof.txt, psexec-ok or a scheduled task named VEEAMPROBE.

What controls would have limited the damage?

Bitdefender recommends separating admin accounts across domains, alerting on any new domain trust, isolating backup servers and keeping immutable copies, limiting WMI, remote registry and ADMIN$ to management hosts, blocking interpreters on machines that do not need them, and running an endpoint agent on every host.

Does this affect people who run AI coding agents?

Not directly: the agent, if any, ran on attacker infrastructure. It does show that an agent with shell access can do the repetitive trial-and-error parts of an intrusion, so scope what your own agents can read and run, and keep privileged credentials out of their reach.

Related reading

• Aur0ra ransomware operators used Cursor agents to reach domain admin
• Wiz: anatomy of an AI-driven cloud attack
• N0n ransomware and exposed OpenCode workspaces
• AI-led attacks in October 2026
• November 2026 attacks timeline

Details reflect Bitdefender's report as published on November 3, 2026 and may change if the researchers update their findings.