3AM ransomware affiliate in a UK school estate: Bitdefender documents backup-credential theft, rogue domain admins and new two-way trusts between Active Directory domains, with a command-retry pattern it reads as a model-driven loop

Bitdefender MDR attributes the intrusion to a 3AM (ThreeAM) ransomware affiliate on the encryptor build and its command-line pattern; the target was a school estate in the UK whose domains began as separate Active Directory environments, and initial access is unknown (Bitdefender, 2026-11-03). In September 2026 the attacker first took credentials from the backup software: a modified copy of a public script read the credentials stored in Veeam's databases on three backup servers and decrypted them with the Windows Data Protection API, and a browser credential database was copied from a terminal server (Bitdefender, 2026-11-03). It then worked with built-in tools (PowerShell, WMI, reg, netsh, rundll32) and a few public ones (an Impacket-like remote-execution tool that returns output over administrative shares, Mimikatz renamed to look like a monitoring binary), enumerated domain trusts from a domain controller, searched SYSVOL logon scripts for the names and subnets of other schools, created two backdoor domain-administrator accounts, joined three separate domains with two-way trusts within about three hours, tried to remove EDR agents, which anti-tampering controls blocked, deleted system-state backups and encrypted machines with a Rust-based encryptor (Bitdefender, 2026-11-03).

Bitdefender's reading, which it calls interpretation and not a finding, is that a model drove part of the work: commands call the Veeam web interface on a port and with a login method that do not match the vendor documentation, output is self-labelled, scripts carry numbered revisions, and retries arrive 40 to 101 seconds apart whatever the size of the change, while a new task takes minutes. Every attacker action Bitdefender saw came from an unmanaged internal host with no agent, so the automation itself was never seen, and Bitdefender says it could not document anything about a language model (Bitdefender, 2026-11-03).