3AM ransomware, which Bitdefender tracks as ThreeAM, hit a UK school estate in September 2026. Bitdefender calls the intrusion a hybrid: some parts look like a person at the keyboard, and others behave like an AI agent retrying commands. It published the analysis on 3 November 2026 and says it is the first case of this kind it has investigated.
This explainer separates what the report shows from what it leaves open. It then lists what a defender should change, because Bitdefender’s own conclusion is that the tools were ordinary and the traces were different.
What Does “Hybrid AI Attack” Mean?
Bitdefender sorts attacks that involve AI into three groups. They differ in who does the work, so they call for different evidence.
| Aspect | What the model does | Example Bitdefender cites |
|---|---|---|
| AI-generated | Writes the malware itself, often in bulk | “Vibeware” in its APT36 research, March 2026 |
| AI-assisted | Speeds up tools that human engineers build | The SilkParasite campaign, August 2026 |
| AI-operated | Chooses and writes commands, reads results and adjusts | The claim tested in this case |
Bitdefender places this case between the groups. It rests the hybrid reading on how commands behave, not on the strategy behind them. The affiliate model, the access and the encryptor are, in its words, ordinary and human.
How Did the Intrusion Unfold?
The target held 47 systems: about 21 servers, 8 of them domain controllers, 10 workstations on Windows 10, and one domain controller on Windows Server 2012 R2. It began as several separate Active Directory domains that were not connected. Bitdefender could not establish the initial access, and the staging host was an unmanaged machine it could not see into.
- Backup credentials readBackup tierThree servers, DPAPI decryption
- Domain admin provenDomain controllersMimikatz, then hive saves
- Two backdoor adminsDomain controllersCreated 14 and 15 September
- Two-way trustsDomain controllersThree domains, 18 September
- Access pushWorkstationsAbout 40 machines
- EDR removal triedWorkstationsBlocked by anti-tampering
- EncryptionWorkstations
The first move on 10 and 11 September was credential theft from three backup servers, using a modified public Veeam script (ATT&CK T1555). The attacker then checked its domain admin rights, dumped credentials with Mimikatz and created two domain admin accounts with names chosen to blend into a school directory. Those steps map to OS credential dumping.
On 13 September the attacker searched SYSVOL for the names and subnets of other schools. On 18 September it built two-way trusts between three domains with netdom and dnscmd (T1484.002), then pushed a script to about 40 machines to grant the backdoor account access. About 50 machines were reached, and Bitdefender says about 37 were encrypted the next morning.
Before encryption, Bitdefender reports that 40 finance share files were staged in registry values, zipped and posted to an attacker page (T1041). Two scripts aimed at Sophos and Bitdefender agents failed because of anti-tampering controls, according to Bitdefender. The ThreeAM encryptor, host.exe, then ran from 05:07 to 05:33 UTC on 19 September and deleted system-state backups with wbadmin (T1486, T1490).
What Makes Bitdefender Think a Model Wrote the Commands?
The strongest sign is a recall error. The attacker’s call to the Veeam REST service used port 9392 with Basic authentication, while Veeam’s REST examples use port 9419 and an OAuth2 token. Bitdefender reads this as a call written from memory: right shape, wrong specifics.
Two smaller signs support it. Bash-style escapes appeared inside Windows PowerShell on 14, 15 and 19 September. A Unix redirect to /dev/null appeared three times in 51 minutes on 13 September and never again.
The behaviour fits too. The attacker probed, left confirmation files, labelled output and numbered script revisions such as av_remove and prx2. On 13 September a command ran, was re-run 41 seconds later, was changed after 49 seconds, and was replaced by a different tool after another 47 seconds.
How Strong Is the Evidence, and What Stays Open?
Bitdefender is careful here, and so should readers be. It grades three separate claims, and only the first is strongly supported.
| Aspect | Status in this case | Why |
|---|---|---|
| A language model generated the commands | Strongly supported | The content of the commands, such as the Veeam error |
| An agentic loop chose each next action | Behaves like one | Retries at a steady 40 to 101 seconds; a person pasting between a shell and a chat window cannot be excluded |
| No human was involved in the hands-on phase | Unsupported | The telemetry does not bear on it |
Bitdefender adds limits of its own. The tooling was public, the encryptor is a conventional Rust-based sample, and no bespoke payload holds natural-language comments. Its log holds only detected events, so every gap is an upper bound. It also says vibeware is about 0.07% of the malware samples it collects each month, and that one case does not make a trend.
That last point matters for how the news is read. The AI part changes how the attack looks in logs, not what it can do. A defender who hears “AI ransomware” should not expect new capabilities. Our Aur0ra analysis and the NCSC assessment for 2028 cover the wider debate.
What Should Defenders Change?
Bitdefender’s advice is to prevent, not race. A loop that retries every minute beats detection that depends on spotting enough events fast enough. These controls stop the first attempt and the hundredth:
- Keep administrative accounts of separate domains separate, and put domain trusts and domain admin accounts under change control. Alert on every new trust and on netdom running.
- Treat backup as a target. Scope backup accounts per domain, isolate backup servers and keep immutable copies that no domain account can delete. Alert on reads of backup software databases.
- Restrict WMI, remote registry, scheduled task creation and ADMIN$ access to known management hosts. Bitdefender notes that the estate still ran 10 workstations on Windows 10, which left support in October 2025, and a domain controller on Windows Server 2012 R2. We would retire or isolate such machines first.
- Block Python and PowerShell on machines that never use them, and put an endpoint agent on every machine.
- Hunt for the loop’s noise: the same command re-run, numbered scripts, probe files such as test123, psexec-ok and da_proof, and registry values under HKLM\SOFTWARE\VC31.
Steps 1 to 4 follow Bitdefender’s recommendations, and step 5 follows the traces it lists. The full indicator set is published by Bitdefender with its report. Schools and trusts that run many domains can start from our education sector page.