ThreeAM Affiliate Let an AI Loop Do the Legwork Before Encrypting Schools

A ThreeAM ransomware affiliate spent nine days inside a UK school estate and, Bitdefender says, a good share of the keyboard work looks like it was done by an AI agent on a loop. Retries landed every 40 to 101 seconds no matter how big the change, scripts came in numbered revisions, and the commands carried the kind of mistakes a language model makes: Bash escapes in PowerShell, 2>/dev/null on Windows, the wrong Veeam port. The ending was conventional: about 37 of 47 machines encrypted on Sept. 19.

Accounts: library, svc_bkpmon
Scheduled tasks: VEEAMPROBE, WindowsTempDiag
Registry: HKLM\SOFTWARE\VC31, HKLM\SOFTWARE values FIN001-FIN040, FINCOUNT
C:\Windows\Temp\1\host.exe (ThreeAM encryptor)
Files: da_proof.txt, grant_lib.ps1, av_remove.ps1, av_remove2.ps1, av_remove3.ps1, crackw.py, fin.zip, psx_mark.txt, sysmon64.exe, svcstat.exe
host.exe SHA256 882f34f27292dd797fc022eeac28dfb070d408d310f4e9be20a2a0cb1e78620d

Source article: 3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop
Publisher: Bitdefender (Business Insights)
Published: November 2026
URL: https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack

Executive Summary

Bitdefender describes an intrusion by an unnamed affiliate of ThreeAM (also written 3AM), a ransomware-as-a-service operation publicly tracked since February 2023, against a UK school estate of about 47 Windows systems spread across several separate Active Directory domains with Veeam backup servers. Initial access was not established. Between Sept. 10 and Sept. 19, 2026 the operator ran a modified public Veeam-Get-Creds.ps1 through Impacket-style remote execution to decrypt stored Veeam credentials, copied Chrome Login Data, saved the SECURITY, SYSTEM and SAM hives with reg save, ran Mimikatz renamed sysmon64.exe, created the backdoor domain admins library and svc_bkpmon, planted the scheduled tasks VEEAMPROBE and WindowsTempDiag, then joined three domains with two-way trusts built by netdom and a dnscmd conditional forwarder and pushed the backdoor account to about 40 machines with grant_lib.ps1. Finance files were Base64-encoded into registry values FIN001 to FIN040, zipped as fin.zip and POSTed to rcv.aspx on an unmanaged host; EDR-removal scripts were blocked by anti-tampering; and on Sept. 19 the Rust encryptor host.exe hit about 37 machines in 26 minutes while wbadmin deleted system-state backups. Bitdefender infers that much of the operator work was driven by an AI agent loop from the retry cadence (40 to 101 seconds regardless of change size), numbered script revisions, self-labeled probe artifacts and characteristic text-authoring errors, but cannot identify the model or rule out a human relaying output. The objective was data theft and extortion and the impact was estate-wide encryption and backup loss. Hunt leads, false positive expectations and indicators are detailed below; the source published no YARA or Sigma rules.

ATT&CK chain: Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Exfiltration → Impact

Hunt Lead Grid

ThreeAM Account, Task and Artifact Sweep

The operator created the domain admin library at 19:06 UTC on Sept. 14 and svc_bkpmon at 00:03 UTC on Sept. 15, by two different routes (a school-management backup job and WinRM), and planted the scheduled task VEEAMPROBE as SYSTEM on the backup server and WindowsTempDiag to run the trust scripts. Staging lived in C:\Windows\Temp, with self-labeled output such as da_proof.txt (proof of domain-admin rights), psx_mark.txt, posted.txt, rc.txt, step1.txt to step3.txt and mimi.log, scripts named grant_lib.ps1, av_remove.ps1 to av_remove3.ps1, hop2.ps1, hop3.ps1, dcboot.ps1, recon_school.ps1, veeam_pull.ps1, trust_*.ps1, job*.cmd, cfg*.txt and prx_go.cmd, portable Python running crackw.py, Mimikatz under the names sysmon64.exe, svcstat.exe, syshealth.exe and random .tmp.exe files, registry key HKLM\SOFTWARE\VC31 and values FIN001 to FIN040 and FINCOUNT, and the encryptor at C:\Windows\Temp\1\host.exe. The detection logic is a retrospective sweep of directory-service changes (Event 4720 and 4728/4732/4756 group additions) for the two account names, Event 4698 and task inventories for the two task names, file-creation telemetry for the listed names under C:\Windows\Temp and SYSVOL, registry telemetry for the VC31 key and FIN values, and the published hashes in the appendix.

Use domain controller security logs, EDR file, process and registry telemetry, and task inventories, and sweep at least 90 days, because Bitdefender lists unexplained Restricted Admin changes in January and a hand-typed session in June that may belong to the same intrusion. Scope to every domain in a multi-domain estate, not just the one that was encrypted, because the trusts made the domains one. Blocking the Mimikatz hash alone is the wrong control since the operator renamed and re-dropped it repeatedly; the account names, task names and probe files are the durable anchors. Any hit on library or svc_bkpmon in a privileged group, VEEAMPROBE, da_proof.txt or the FIN values is an active intrusion and should go straight to incident response with the domain treated as compromised.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1136.002 (Create Account: Domain Account); Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task) (mapping per source article)

Sources: “3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop”, Bitdefender, Nov. 2026, https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack (source article); “2026_11-3am-iocs.csv”, Bitdefender malware-ioc repository, https://github.com/bitdefender/malware-ioc/blob/master/2026_11-3am-iocs.csv (indicator file linked from the source article)

Registry Hive Export Outside the Backup Tool

On Sept. 14 the operator ran reg save against the SECURITY and SYSTEM hives on the Windows Server 2012 R2 domain controller, writing sec.save and sys.save into C:\Windows\Temp, and elsewhere saved SAM as well and dumped SAM and SECURITY remotely over the winreg interface. Those exports give offline access to local account hashes, cached domain credentials and LSA secrets, including service account passwords. The detection logic is a process-creation rule for reg.exe whose command line contains save (or export) and HKLM\SAM, HKLM\SECURITY or HKLM\SYSTEM, raised in priority when the output path is under C:\Windows\Temp or a user-writable directory, when the parent is a remote execution service, WmiPrvSE.exe or a script host, or when the host is a domain controller; add a second rule for remote registry access to the SAM and SECURITY keys from a non-administrative host.

Use EDR process telemetry with command lines (Sysmon Event ID 1 or Windows 4688 with command-line auditing), file-creation events for .save or .hiv files, and Event 5145 for winreg named-pipe access. Sweep 90 days and scope fleet-wide, with domain controllers and backup servers at the top. Allowlist the signed images of your backup or imaging product by path and signer rather than by process name, since attackers can rename reg.exe copies but rarely bother. Disabling the Remote Registry service where it isn’t needed is the right preventive step; blocking reg.exe itself breaks administration. This pattern generalizes to most ransomware crews and to red-team tooling, and a hit on a domain controller should be escalated immediately because it implies the attacker already has domain-level rights.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1003.002 (OS Credential Dumping: Security Account Manager); Credential Access → T1003.004 (OS Credential Dumping: LSA Secrets) (our mapping; the source lists T1003)

Sources: “3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop”, Bitdefender, Nov. 2026, https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack (source article)

Base64 File Chunks Staged in HKLM\SOFTWARE

On Sept. 15 the operator selected up to 40 finance files by size and extension, Base64-encoded each into its own registry value named FIN001 through FIN040 under HKLM\SOFTWARE with a FINCOUNT value holding the total, and used HKLM\SOFTWARE\VC31 for an earlier transport. The data was then copied with robocopy to the unmanaged host’s C$ share and to another domain’s SYSVOL (finance_mirror and finmirror folders), zipped as fin.zip with Compress-Archive and POSTed to http://<unmanaged host>/rcv.aspx?f=fin.zip, with status messages sent to rcv.aspx?f=status.txt. The registry is an odd place to stage files, which is the point: it moves data between processes and hosts through remote registry without writing obvious archives. The detection logic is a registry-set rule that counts values written under the root of HKLM\SOFTWARE (not under a vendor subkey) by powershell.exe, reg.exe or a remote registry session, firing when more than a handful of sequentially numbered values or any single value larger than a few hundred kilobytes appear within a short window, and a companion network rule for HTTP POSTs to an .aspx endpoint on an internal host that isn’t a known web server.

Use EDR or Sysmon registry events (Event IDs 12 to 14) with value size where your sensor records it, plus proxy or internal NetFlow for the POSTs. Sweep 30 to 90 days, focusing on finance, file and backup servers. Expect some legitimate software to keep blobs in the registry; allowlist by writing image and vendor key, not by value name, since FIN is trivially changeable. Hash-based controls are useless here because the data is the victim’s own. Any confirmed staging pattern means exfiltration is under way or done and should trigger incident response plus a data-exposure review of the files named in the values. The technique generalizes to any actor that uses the registry as a covert staging area.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1112 (Modify Registry); Collection → T1074.001 (Data Staged: Local Data Staging) (T1112 per source article; T1074.001 our refinement of the source’s T1074)

Sources: “3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop”, Bitdefender, Nov. 2026, https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack (source article)

Unapproved Domain Trust and DNS Forwarder Build

Between 15:39 and 18:37 UTC on Sept. 18 the operator added a DNS conditional forwarder with dnscmd, built two-way trusts with netdom at 16:09 and 16:16, ran diagnostic batch files (diag_member.bat, diag_nl.bat, lmhosts_test.bat) from 16:26, pushed grant_lib.ps1 to about 40 machines from 16:36 with retries at 17:07 and 17:22, verified the trusts at 17:23 and restarted Netlogon at 18:36. Earlier, on Sept. 13, it had run nltest /domain_trusts and searched SYSVOL for other schools’ names and subnets. Joining previously separate domains let a single set of stolen credentials reach every school, which is why about 37 machines across domains were encrypted in one 26-minute run. The detection logic correlates, per domain controller within a 24-hour window, a trust creation event (Event 4706, or 4716 for a modified trust), a DNS server configuration change adding a conditional forwarder (DNS Server audit events or dnscmd /zoneadd with /forwarder on the command line), process creation of netdom trust or nltest /domain_trusts, and either a domain account created in the prior 96 hours or a privileged group addition, and checks the trust against approved change records.

Use domain controller security and DNS Server audit logs, EDR process telemetry on domain controllers and admin hosts, and your change-management records as the allowlist. Sweep 180 days, since trusts persist indefinitely and outlive an incident. Scope to all domain controllers in every forest you own. Detecting netdom by name alone is fragile and can be bypassed with PowerShell or LDAP, so anchor on the 4706 event and the forwarder change, which the operator cannot avoid. Blocking netdom is the wrong control; requiring trust changes to go through a ticket and alerting on any that don’t is the right one. Any unapproved trust is a critical incident: the forest boundary has been redrawn by someone else, and the trust plus any new privileged accounts should be removed only once incident response has scoped access. This generalizes to any intruder in a multi-domain estate.

Hunt Lead Level: 3 (Elite)

ATT&CK: Defense Evasion → T1484.002 (Domain or Tenant Policy Modification: Trust Modification); Discovery → T1482 (Domain Trust Discovery) (mapping per source article)

Sources: “3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop”, Bitdefender, Nov. 2026, https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack (source article)

Hash Appendix

ThreeAM encryptor and tooling

MD5s and SHA-256s come from Bitdefender’s indicator file linked from the source article; SHA-1s are not available (OTX AlienVault and VirusTotal not checked). Mimikatz and the Impacket-style tool are public offensive tools, not legitimate software, so blocking their hashes is safe but easy to evade by recompiling.

MD5s
4ed9b13ac7a4b0d937dbd3fbfa62c604  # host.exe -> C:\Windows\Temp\1\host.exe, ThreeAM Rust encryptor
29efd64dd3c7fe1e2b022b7ad73a1ba5  # mimikatz.exe -> also sysmon64.exe, syshealth.exe, 2tf4g3n1.tmp.exe, jb17klxh.tmp.exe, Mimikatz
d2d3e1f8023b12fb89e400c7e8ecd7db  # m.zip -> Mimikatz release archive pulled from public GitHub
6983f7001de10f4d19fc2d794c3eb534  # Impacket-style remote execution tool

SHA1s
(not available)  # host.exe -> C:\Windows\Temp\1\host.exe, ThreeAM Rust encryptor
(not available)  # mimikatz.exe -> also sysmon64.exe, syshealth.exe, 2tf4g3n1.tmp.exe, jb17klxh.tmp.exe, Mimikatz
(not available)  # m.zip -> Mimikatz release archive pulled from public GitHub
(not available)  # Impacket-style remote execution tool

SHA256s
882f34f27292dd797fc022eeac28dfb070d408d310f4e9be20a2a0cb1e78620d  # host.exe -> C:\Windows\Temp\1\host.exe, ThreeAM Rust encryptor
61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1  # mimikatz.exe -> also sysmon64.exe, syshealth.exe, 2tf4g3n1.tmp.exe, jb17klxh.tmp.exe, Mimikatz
7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5  # m.zip -> Mimikatz release archive pulled from public GitHub
3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71  # Impacket-style remote execution tool

Operator PowerShell scripts

MD5s only, from Bitdefender’s indicator file; SHA-1 and SHA-256 were not published (OTX AlienVault and VirusTotal not checked). The scripts were revised repeatedly, so hash matches will miss later versions; hunt the names and paths too.

MD5s
f18b156db3fbef4df2fc486bc14ea8f0  # hop2.ps1 -> operator script
50a6fd4f72ebcbacc8a37e603bbec197  # hop3.ps1 -> operator script
c3afeee5b8e822c4befdf17ff3a92dc0  # grant_lib.ps1 (v1) -> pushes backdoor account access estate-wide
0713e03873599c185caf9ffccec4cae9  # grant_lib.ps1 (v2) -> pushes backdoor account access estate-wide
00cc41695d4a07073322981e19fbd28b  # av_remove.ps1 -> EDR/AV removal
f3a298b3b0bf4fd246b3a2d4ad8901ed  # av_remove3.ps1 -> EDR/AV removal
5090e942173e25bd8296d6d3d9c0e204  # svc_*.ps1 -> loader

SHA1s
(not available)  # hop2.ps1 -> operator script
(not available)  # hop3.ps1 -> operator script
(not available)  # grant_lib.ps1 (v1) -> pushes backdoor account access estate-wide
(not available)  # grant_lib.ps1 (v2) -> pushes backdoor account access estate-wide
(not available)  # av_remove.ps1 -> EDR/AV removal
(not available)  # av_remove3.ps1 -> EDR/AV removal
(not available)  # svc_*.ps1 -> loader

SHA256s
(not available)  # hop2.ps1 -> operator script
(not available)  # hop3.ps1 -> operator script
(not available)  # grant_lib.ps1 (v1) -> pushes backdoor account access estate-wide
(not available)  # grant_lib.ps1 (v2) -> pushes backdoor account access estate-wide
(not available)  # av_remove.ps1 -> EDR/AV removal
(not available)  # av_remove3.ps1 -> EDR/AV removal
(not available)  # svc_*.ps1 -> loader

References Appendix

• “3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop”, Bitdefender, Nov. 2026, https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack (source article; timeline, tooling, persistence, exfiltration and ATT&CK mapping)
• “2026_11-3am-iocs.csv”, Bitdefender malware-ioc repository, https://github.com/bitdefender/malware-ioc/blob/master/2026_11-3am-iocs.csv (hashes, file names, accounts, tasks and registry indicators)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/