ARTICLE ORIGINAL MAG212 CYBER

Attaque par ransomware à 3 h du matin dans un établissement scolaire britannique : identifiants Veeam, domaines frauduleux et suspicion de boucle d’IA

novembre 4, 2026 · El Mostafa Ouchen

3AM Ransomware at a UK School Estate: Backups, Trusts and an AI Loop

Bitdefender has published a detailed reconstruction of a September 2026 intrusion at a UK school estate by a 3AM (ThreeAM) ransomware affiliate. Over ten days the intruder took stored credentials from the school’s Veeam backup servers, created two backdoor Domain Admin accounts, joined three previously separate Active Directory domains with new trusts, stole finance data, and encrypted about 37 machines.

Bitdefender also suspects the attacker used an automated, AI-assisted command loop. The more useful lesson for school IT teams and MSPs is how the intrusion could have been caught: almost every step was noisy and repetitive.

Faits clés

ArticleDétail
VictimA UK school estate with several separate AD domains
Intrusion windowSeptember 10–19, 2026 (UTC)
ReportBitdefender, November 3, 2026
EncryptorThreeAM, Rust-based (host.exe)
ImpactAbout 37 machines encrypted; system-state backups deleted; finance data exfiltrated
Initial accessNot established; the attacker worked from an unmanaged host

How the intrusion unfolded

Timeline from 10 to 19 September 2026 of the 3AM intrusion: backup credential theft, domain admin backdoors, domain trusts and encryption
Selected events from Bitdefender’s timeline. Outcomes of some steps, such as an LSASS dump and a Veeam REST call, are unknown. MAG212 CYBER original diagram.
  • Sep 10–11, backup credentials: a modified public PowerShell script read stored credentials from the Veeam configuration database on three backup servers and decrypted them with DPAPI. A Chrome login database was copied from a terminal server.
  • Sep 12–14, credential theft and recon: a Mimikatz download (later renamed sysmon64.exe), a Defender exclusion attempt, registry hive saves, domain-trust discovery with nltest, and SYSVOL searches for other schools.
  • Sep 14–15, backdoor admins: accounts library et svc_bkpmon were created and added to Domain Admins. Names were chosen to blend into a school’s account list. Finance data was staged in registry values and sent out.
  • Sep 18, domain trusts: DNS conditional forwarders and two-way trusts were created among three separate domains, then access was pushed to about 40 machines.
  • Sep 19, impact: scripts tried to remove Sophos and Bitdefender protection, wbadmin deleted system-state backups, and the encryptor ran between 05:07 and 05:33 UTC.
Conceptual diagram of three school Active Directory domains joined by attacker-created two-way trusts
How the attacker linked separate domains. Domain labels are generic; the exact trust pairing is simplified. MAG212 CYBER original diagram.

A trust on its own grants no permissions. That is why the attacker followed it with a script that pushed the backdoor account’s access across the estate.

Was AI involved?

Bitdefender points to sequences of slightly modified retries issued every 40 to 100 seconds, which look like an automated agent loop. But it could not see the attacker’s machine. It cannot name a model, say whether one ran locally, or rule out a human copying output between tools. It presents the “hybrid” human-plus-agent reading as a working model, not a fact, and calls this one case, not a trend.

For defenders the takeaway is the same either way. Self-logging, repetitive scripts leave loud traces. This intrusion succeeded because nobody was alerted when backup credentials were read or when new domain trusts appeared.

What to look for in your environment

  • Security log: 4720 (account created), 4728 (member added to a global group such as Domain Admins), 4706 (new domain trust), 4698 (scheduled task created). System log: 7045 (service installed).
  • Behavior: reg save of SAM, SECURITY or SYSTEM by non-backup tools; netdom trust ou nltest /domain_trusts; any process querying the Veeam credentials database.
  • Case-specific artifacts: tasks VEEAMPROBE et WindowsTempDiag, registry key HKLM\SOFTWARE\VC31, scripts grant_lib.ps1 et av_remove*.ps1. Bitdefender publishes the full IOC set on GitHub. Expect different names in other intrusions, and hunt for the behavior.

Read-only checks (PowerShell 5.1+ with the RSAT ActiveDirectory module; run the event and task queries elevated, on each DC or server):

Get-ADTrust -Filter * -Properties whenCreated | Select-Object Name,Direction,whenCreated
Get-ADGroupMember 'Domain Admins' -Recursive | Select-Object SamAccountName
$since = (Get-Date).AddDays(-60)
Get-ADUser -Filter 'whenCreated -ge $since' -Properties whenCreated |
  Select-Object SamAccountName,whenCreated
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4706,4720,4728} -MaxEvents 200
Get-ScheduledTask -TaskName 'VEEAMPROBE','WindowsTempDiag' -ErrorAction SilentlyContinue

Escalate any trust you cannot account for, and any admin added outside change control. These commands were checked against Microsoft documentation but not run against live systems for this article.

Contain, recover and prevent

  1. Isolate backup servers and rotate every credential the backup product stores. Treat them as compromised if they could have been read.
  2. Disable unknown admin accounts and remove unapproved trusts. If domain compromise is confirmed, reset the krbtgt account twice, following Microsoft guidance.
  3. Restore only from immutable or offline copies, and only after the environment is clean.
  4. Prevent repeats: keep backup accounts scoped per domain, keep backup servers off general admin networks, put trusts and Domain Admin changes under change control, and deploy an endpoint agent on every machine. Bitdefender specifically recommends alerting on backup-credential access and new trusts.

Foire aux questions

How did the attackers get in?

Bitdefender could not establish initial access. The attacker operated from a host the school did not manage, outside Bitdefender’s visibility.

Why target the Veeam servers first?

Backup products often store privileged credentials for the systems they protect. Reading them gave the attacker wide access early, and controlling backups weakens recovery.

Is AI-driven ransomware now common?

Not on this evidence. Bitdefender calls this a single case and says such “vibeware” accounts for about 0.07% of the samples it collects monthly.

Read today’s full MAG212 CYBER Daily (free) →
Abonnez-vous gratuitement

Sources

Articles connexes sur MAG212 CYBER