---
id: "CMP-202611-jlqzrj"
kind: "campaign"
aliases: []
title: "3AM ransomware affiliate uses an AI agent loop to steal Veeam backup credentials, add rogue domain admins and link separate AD domains before encrypting (Bitdefender)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Veeam Backup & Replication", "fixed": []}, {"name": "Active Directory", "fixed": []}, {"name": "Windows Server", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-03T14:37:19+00:00"
updated_at: "2026-11-03T14:37:19+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T14:37:19+00:00"}]
---

# 3AM ransomware affiliate uses an AI agent loop to steal Veeam backup credentials, add rogue domain admins and link separate AD domains before encrypting (Bitdefender)

A 3AM (ThreeAM) ransomware affiliate breached a UK school estate between 10 and 19 September 2026 and encrypted about 37 of nearly 50 machines (Bitdefender, confirmed attribution). Working from an unmanaged internal host, it decrypted stored credentials on three Veeam backup servers with a published PowerShell script, copied Chrome credential databases, dumped LSASS with Mimikatz, created backdoor domain admins, built two-way trusts between three previously separate Active Directory domains to reach other schools, removed Sophos and Bitdefender agents, deleted system-state backups and ran the Rust encryptor. Command retries every 40-101 seconds point to an LLM agentic loop doing the mechanical work, with a human picking the steps. Initial access is unknown. Other victims of this method are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Veeam Backup & Replication affected ? fixed ?
- :Active Directory affected ? fixed ?
- :Windows Server affected ? fixed ?

## How to check

Look for new domain admin accounts named 'library' or 'svc_bkpmon'; new or two-way Active Directory domain trusts you did not create, then Netlogon restarts and trust diagnostic probes; PowerShell on Veeam servers reading or decrypting the Veeam configuration database credentials; access to Veeam's REST API on unusual ports; LSASS dumps or Mimikatz; Chrome 'Login Data' copied off endpoints; Sophos or Bitdefender agents being uninstalled; deletion of Windows system-state backups (wbadmin); a host.exe run with an ID and a speed argument; files with the .threeamtime extension; activity from internal machines with no EDR agent.

## Fix

Alert on any new AD domain trust and on new Domain Admins members; remove unknown admin accounts and trusts. Restrict who can log on to Veeam backup servers, keep them off the domain or tiered, and rotate the credentials Veeam stores. Find and put EDR on unmanaged hosts. Turn on EDR tamper protection. Keep offline or immutable backups.

## Timeline

- 2026-11-03T14:37:19+00:00 analyst

## Documents

- [describes] 3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop https://businessinsights.bitdefender.com/3am-ransomware-hybrid-ai-attack

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_