{"id":"CMP-202611-jlqzrj","kind":"campaign","aliases":[],"related":[],"title":"3AM ransomware affiliate uses an AI agent loop to steal Veeam backup credentials, add rogue domain admins and link separate AD domains before encrypting (Bitdefender)","description":null,"summary":"A 3AM (ThreeAM) ransomware affiliate breached a UK school estate between 10 and 19 September 2026 and encrypted about 37 of nearly 50 machines (Bitdefender, confirmed attribution). Working from an unmanaged internal host, it decrypted stored credentials on three Veeam backup servers with a published PowerShell script, copied Chrome credential databases, dumped LSASS with Mimikatz, created backdoor domain admins, built two-way trusts between three previously separate Active Directory domains to reach other schools, removed Sophos and Bitdefender agents, deleted system-state backups and ran the Rust encryptor. Command retries every 40-101 seconds point to an LLM agentic loop doing the mechanical work, with a human picking the steps. Initial access is unknown. Other victims of this method are unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-03T14:37:19+00:00","products":[{"name":"Veeam Backup & Replication","fixed":[]},{"name":"Active Directory","fixed":[]},{"name":"Windows Server","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for new domain admin accounts named 'library' or 'svc_bkpmon'; new or two-way Active Directory domain trusts you did not create, then Netlogon restarts and trust diagnostic probes; PowerShell on Veeam servers reading or decrypting the Veeam configuration database credentials; access to Veeam's REST API on unusual ports; LSASS dumps or Mimikatz; Chrome 'Login Data' copied off endpoints; Sophos or Bitdefender agents being uninstalled; deletion of Windows system-state backups (wbadmin); a host.exe run with an ID and a speed argument; files with the .threeamtime extension; activity from internal machines with no EDR agent.","fix":"Alert on any new AD domain trust and on new Domain Admins members; remove unknown admin accounts and trusts. Restrict who can log on to Veeam backup servers, keep them off the domain or tiered, and rotate the credentials Veeam stores. Find and put EDR on unmanaged hosts. Turn on EDR tamper protection. Keep offline or immutable backups.","status":"open","published_at":null,"first_seen_at":"2026-11-03T14:37:19+00:00","triaged_at":"2026-11-03T14:37:19+00:00","updated_at":"2026-11-03T14:37:19+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-101':136B '-202611':27A '10':53B '19':55B '2026':57B '37':61B '3am':1A,29A,43B '40':135B '50':64B 'access':155B 'activ':110B 'active':34A 'ad':21A 'add':14A 'admin':17A,100B 'affili':3A,46B 'agent':7A,121B,142B 'ai':6A 'attribut':68B 'backdoor':98B 'backup':12A,32A,82B,126B 'bitdefend':25A,66B,120B 'breach':47B 'built':101B 'campaign':38B 'chrome':90B 'cmp':26A 'command':132B 'confirm':67B 'copi':89B 'creat':97B 'credenti':13A,78B,91B 'databas':92B 'decrypt':76B 'delet':122B 'directori':111B 'directory':35A 'domain':16A,22A,99B,112B 'dump':93B 'earli':40B 'early-warn':39B 'encrypt':24A,59B 'encryptor':131B 'estat':51B 'everi':134B 'host':74B 'human':150B 'initi':154B 'intern':73B 'jlqzrj':28A 'link':19A 'llm':141B 'loop':8A,143B 'lsass':94B 'machin':65B 'mechan':146B 'method':162B 'mimikatz':96B 'near':63B 'pick':151B 'point':138B 'powershel':87B 'previous':108B 'publish':86B 'ran':128B 'ransomwar':2A,45B 'reach':114B 'remov':117B 'replication':33A 'retri':133B 'rogu':15A 'rust':130B 'school':50B,116B 'script':88B 'second':137B 'separ':20A,109B 'septemb':56B 'server':37A,83B 'sopho':118B 'state':125B 'steal':10A 'step':153B 'store':77B 'system':124B 'system-st':123B 'three':80B,107B 'threeam':30A,44B 'trust':105B 'two':103B 'two-way':102B 'uk':49B 'unknown':157B,164B 'unmanag':72B 'use':4A 'veeam':11A,31A,81B 'victim':159B 'warn':41B 'way':104B 'windows':36A 'work':69B,147B","nicknames":["3AM","ThreeAM"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["3am","activedirectory","backupreplication","directory","server","threeam","veeambackupreplication","windowsserver"],"ptokens":["active","backup","directory","replication","server","veeam","windows"],"labels":["campaign","earlywarning","high","other"],"first_public_at":"2026-11-03T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-jlqzrj","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T14:37:19+00:00","fetched_at":"2026-11-03T14:37:19+00:00","note":null}],"documents":[{"id":58038,"url":"https://businessinsights.bitdefender.com/3am-ransomware-hybrid-ai-attack","title":"3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop","kind":"blog","source":"analyst","publisher":null,"text":"Bitdefender: 3AM (ThreeAM) ransomware affiliate breached a UK school estate 10-19 Sep 2026 from an unmanaged internal host; initial access unknown. Living off the land (PowerShell, WMI/wmic, reg, netsh, rundll32), Impacket-style remote exec, Mimikatz, LSASS dumps, published Veeam credential-decrypt script against three Veeam backup servers, Chrome credential DB copy. Searched SYSVOL for other schools, created backdoor domain admins 'library' and 'svc_bkpmon', built two-way trusts between three separate AD domains, removed Sophos/Bitdefender agents, deleted system-state backups, deployed Rust encryptor host.exe (ID and speed args); ~37 of ~50 machines encrypted. Command retries every 40-101s suggest an LLM agentic loop handling mechanical work with a human choosing steps.","published_at":"2026-11-03T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}