Cybersecurity firm Bitdefender has investigated what it believes is Europe’s first ransomware incident involving a human operator and suspected AI-driven command retries.
In research shared with Hackread.com ahead of its publication, the cybersecurity firm detailed how a 3AM (ThreeAM) ransomware affiliate breached a UK school estate with 47 systems across separate Active Directory domains and encrypted about 37 machines.
3AM ransomware group’s dark web leak site
Human Decisions, Automated Retries
In its blog post, published today, Bitdefender described the intrusion as “a hybrid operation in which some parts show a human operator at the keyboard while others behave like an agentic loop.” The suspected loop fed command results back to a language model, which then suggested alternative commands.
The timing supports that interpretation: key steps were minutes apart, while failed commands were retried every 40 to 101 seconds. However, Bitdefender could not confirm whether a model was running the loop automatically or whether an operator was copying commands and results between a terminal and an AI tool.
How the attacker used Windows services to execute commands and retrieve results. Bitdefender could not confirm whether a person or an AI model selected the next command. (Source: Bitdefender)
The distinction matters. This was not a confirmed autonomous ransomware attack. The evidence points to possible AI assistance within an operation that still relied on conventional intrusion techniques.
The affiliate mainly used living-off-the-land techniques, relying on Windows tools such as PowerShell, WMI, netsh, reg and rundll32. It also used public tools, including Mimikatz and Impacket-style remote execution, alongside the 3AM encryptor. As Bitdefender noted, AI-enabled attacks do not need novel tools to succeed.
Domain Trusts and Ransomware Deployment
The attacker stole backup credentials on September 10 and 11 using scripts that decrypted stored passwords with Windows DPAPI and copied browser credentials. Mimikatz was downloaded on September 12, then renamed to sysmon64.exe. On September 14, the attacker dumped registry hives and created backdoor administrator accounts named library and svc_bkpmon.
On September 15, files from a finance share were staged in Windows registry values and transferred through an unmanaged machine used as command-and-control infrastructure.
On September 18, the attacker used dnscmd to create DNS conditional forwarders, then netdom to establish two-way trusts between separate domains. Diagnostic scripts, including wb_probe, ran trust-verification commands, but Bitdefender could not determine what the probes returned. Netlogon was restarted later that day. A scheduled PowerShell task then pushed the backdoor account’s access to about 40 machines.
The following day, attempts to remove Sophos and Bitdefender endpoint protection were blocked by anti-tampering controls. The attacker deployed a script loader before running the Rust-based 3AM encryptor, which encrypted about 37 systems and deleted system-state backups with wbadmin.
Timeline of the school attack, from credential theft to ransomware deployment in September 2026. All times are UTC. (Source: Bitdefender)
The findings raise a practical concern for defenders. Even if AI helped troubleshoot the attack, the damage came through familiar weaknesses involving credentials, domain trust and backup protection, and Bitdefender expects hybrid attacks to become more common in 2027.
Researchers recommend that defenders should start separating privileged accounts across domains, monitoring new domain trusts, protecting backup infrastructure and ensuring every machine has endpoint protection.
——————————————————–
Click Here For The Original Source.
