3AM ransomware (suspected AI-assisted): UK school estate, ~37 of 50 machines encrypted after AD changes
Severity: high · Patch status: no-fix-needed · Since 2026-11-03
BleepingComputer (2026-11-03), citing Bitdefender researchers, reports that a 3AM ransomware affiliate attacked a UK school estate on September 10 to 19 (the article gives no year), encrypting about 37 of nearly 50 reachable machines from an unmanaged host. The intrusion used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome credential database, deployed Mimikatz and LSASS memory dumpers, mapped domain relationships, and created two backdoor domain admin accounts named 'library' and 'svcbkpmon'. The attacker then set up two-way trusts linking three previously separate Active Directory domains, stole financial data, tried to disable Sophos and Bitdefender protection, deleted system-state backups, and deployed the Rust-based 3AM encryptor. The AI element is Bitdefender's belief, not a confirmed finding: the researchers believe the operator may have used AI-generated commands in an automated agentic loop, based on repeated, slightly modified commands issued every 40 to 100 seconds. They could not access the attacker's machine, cannot document the model, and cannot rule out a person relaying commands and results. The initial access method is unknown. Per BleepingComputer, 3AM emerged in 2023 and has been linked to the Conti and Royal gangs.
What to do
- Hunt for and remove unauthorized domain admin accounts, especially accounts like 'library' and 'svc_bkpmon', and audit all domain trust relationships for unexpected two-way trusts
- Secure Veeam backup servers: patch, restrict access, rotate stored credentials, and ensure backups are immutable/offline so system-state backups cannot be deleted
- Harden credential storage: clear browser-saved passwords, enforce LSASS protection (Credential Guard), and monitor for Mimikatz and LSASS dump artifacts
- Ensure endpoint protection (Sophos, Bitdefender) has tamper protection enabled and alert on attempts to disable or uninstall it
- Investigate unmanaged hosts and bring all devices into MDM/EDR coverage; monitor for scripted command patterns at regular intervals indicative of automation
- Prepare for AI-assisted ransomware as the UK NCSC's annual report urges (per BleepingComputer): verify detection coverage, test recovery, and review segmentation between domains and sites
Sources
All live incidents on Threat Watch
