Live › campaign › CMP-202611-jlqzrj
A 3AM (ThreeAM) ransomware affiliate breached a UK school estate between 10 and 19 September 2026 and encrypted about 37 of nearly 50 machines (Bitdefender, confirmed attribution). Working from an unmanaged internal host, it decrypted stored credentials on three Veeam backup servers with a published PowerShell script, copied Chrome credential databases, dumped LSASS with Mimikatz, created backdoor domain admins, built two-way trusts between three previously separate Active Directory domains to reach other schools, removed Sophos and Bitdefender agents, deleted system-state backups and ran the Rust encryptor. Command retries every 40-101 seconds point to an LLM agentic loop doing the mechanical work, with a human picking the steps. Initial access is unknown. Other victims of this method are unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 14:37 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam Backup & Replication | – | – | – |
| Active Directory | – | – | – |
| Windows Server | – | – | – |
Look for new domain admin accounts named library or svc_bkpmon; new or two-way Active Directory domain trusts you did not create, then Netlogon restarts and trust diagnostic probes; PowerShell on Veeam servers reading or decrypting the Veeam configuration database credentials; access to Veeams REST API on unusual ports; LSASS dumps or Mimikatz; Chrome Login Data' copied off endpoints; Sophos or Bitdefender agents being uninstalled; deletion of Windows system-state backups (wbadmin); a host.exe run with an ID and a speed argument; files with the .threeamtime extension; activity from internal machines with no EDR agent.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("CMP-202611-jlqzrj")