ThreeAM Affiliate Let an AI Loop Do the Legwork Before Encrypting Schools
Bitdefender says a ThreeAM ransomware affiliate spent nine days in a UK school estate, likely driving much of the work with an AI agent loop: Veeam credential theft, backdoor domain admins, new domain trusts, registry-staged finance data and, on Sept. 19, about 37 machines encrypted.