VULNpocalypse
HighBreach / campaignMonitoring

3AM ransomware encrypts 37 machines in UK school estate in suspected AI-assisted attack

A 3AM ransomware affiliate encrypted 37 machines in a UK school estate in September 2026, with Bitdefender suspecting AI-assisted command retries.

Published
Updated
Exploitation
Yes, Bitdefender documented a 3AM affiliate encrypting 37 machines in a UK school estate between September 10 and 19, 2026

What happened

Bitdefender researchers documented a 3AM ransomware affiliate attack on a UK school estate. The activity ran from September 10 to 19, 2026, and the affiliate encrypted around 37 machines (BleepingComputer, Infosecurity Magazine). Bitdefender could not establish how the attacker first got in (BleepingComputer). Investigators did not identify a Veeam vulnerability as the entry point (GBHackers).

Attack chain, as reported:

  • The attacker used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome credential database, and deployed Mimikatz and LSASS memory-dumping tools (BleepingComputer).
  • Mimikatz was renamed sysmon64.exe. The attacker dumped registry hives and created two backdoor domain administrator accounts named library and svc_bkpmon (Hackread).
  • Finance files were staged in Windows registry values and sent over HTTP POST to an unmanaged internal machine that served as command-and-control infrastructure (Hackread, GBHackers). Infosecurity Magazine calls the registry-as-transport channel an unusual choice and a strong indicator to hunt for (Infosecurity Magazine).
  • The attacker used dnscmd to create DNS conditional forwarders and netdom to set up two-way trusts between three previously separate domains. Netlogon was restarted, and a scheduled PowerShell task pushed the backdoor account’s access to about 40 machines (Hackread).
  • Attempts to remove Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls. A loader was then deployed and the Rust-based 3AM encryptor ran, deleting system-state backups with wbadmin (Hackread). GBHackers reports the encryptor ran between 05:07 and 05:33 UTC (GBHackers).

The AI angle. Bitdefender saw repeated commands, each slightly modified, issued at regular intervals. Failed commands were retried every 40 to 101 seconds, while steps between tasks were minutes apart (Hackread). Bitdefender described a hybrid operation in which some parts show a human at the keyboard and others behave like an agentic loop (Hackread). It could not access the attacker’s machine, so it cannot say which model was used, whether it ran locally or remotely, or whether a person was copying text between the implant and a model (BleepingComputer). This was not a confirmed autonomous attack (Hackread). The case is one investigation, not evidence of a wider autonomous-ransomware trend (GBHackers).

Details that differ between sources.

  • Environment size: Hackread and GBHackers say the estate had 47 systems, while BleepingComputer and Infosecurity Magazine say the attacker reached nearly 50 or 50 machines from the unmanaged host.
  • Trust creation date: Hackread and GBHackers say September 18, while Infosecurity Magazine says September 19.
  • Retry interval upper bound: BleepingComputer says 40 to 100 seconds, the other outlets say 40 to 101.

Am I affected?

This is an intrusion campaign, not a software flaw. No CVE and no patch are named in the sources, and the initial access method is not confirmed.

You have a similar risk profile if any of these apply:

  • You run several Active Directory domains, especially where privileged credentials for more than one domain are kept in one place.
  • Your backup servers, such as Veeam, store credentials that could be decrypted and reused.
  • Unmanaged hosts on your network can reach managed machines.
  • Some machines have no endpoint agent.
  • You find the indicators below, including unexpected trusts, the accounts library or svc_bkpmon, Mimikatz under a misleading name such as sysmon64.exe, or registry-based file staging.

Whether other organizations were affected is not confirmed. Infosecurity Magazine reports the attackers built domain trust in order to reach other schools (Infosecurity Magazine).

What to do now

  1. Hunt for unexpected domain trusts, new trust-related changes such as dnscmd conditional forwarders and netdom activity, and unplanned Netlogon restarts (GBHackers, Hackread).
  2. Check for new privileged accounts, including domain admins named library and svc_bkpmon, and review any accounts created by separate routes (Hackread, Infosecurity Magazine).
  3. Audit access to backup credentials and treat backup infrastructure as a target. Review backup databases, stored secrets, registry-hive exports, and any processes decrypting stored passwords (GBHackers, Infosecurity Magazine).
  4. Look for Mimikatz renamed as sysmon64.exe, LSASS dumping, and unusual registry-based file staging such as Base64-encoded values holding file content (Hackread, GBHackers).
  5. Keep the administrative accounts of separate domains separate, and never keep privileged credentials for several domains in one place (Infosecurity Magazine).
  6. Restrict remote execution and administrative shares, and block interpreters and shells on machines that never use them (Infosecurity Magazine).
  7. Put an endpoint agent on every machine, and keep anti-tampering controls enabled, since they blocked removal attempts in this incident (Infosecurity Magazine, Hackread).
  8. Watch for wbadmin deleting system-state backups, and keep backup copies that an attacker with domain admin rights cannot reach. The wbadmin point comes from the sources, the offline-copy advice is general practice and not from them (Hackread).
  9. Keep identity, endpoint and network telemetry available, because AI involvement changes what the traces look like during an incident (GBHackers, Infosecurity Magazine).

Sources