As reported by BleepingComputer, Bitdefender researchers have published findings from a 3AM ransomware incident at a UK school estate that display hallmarks of AI-assisted execution. The forensic trail — repeated, slightly modified commands issued at regular 40-to-100-second intervals — is consistent with an automated agentic loop rather than manual operator keystrokes. This matters less for what it proves than for what it portends.
Why This Incident Deserves Attention
Ransomware operators have long sought to compress the time between initial access and encryption. What is new here is the suggestion that an AI agent — local or remote — may be performing the intermediate steps: credential harvesting, AD reconnaissance, trust manipulation, and endpoint defense evasion. Bitdefender is appropriately cautious, noting they could not inspect the attacker's workstation. But the behavioral fingerprint is enough to warrant industry-wide attention.
The attack itself followed a recognizable playbook: Veeam credential extraction, Chrome database theft, Mimikatz and LSASS dumping, creation of backdoor domain admin accounts (library and svc_bkpmon), cross-domain trust establishment, removal of endpoint protection, and deployment of 3AM's Rust-based encryptor. What stands out is the cadence — the mechanical regularity of command variation suggests a loop iterating toward success rather than a human reasoning through obstacles.
Who Is at Risk
Broader Implications
If threat actors are moving toward AI-assisted execution, the defender's advantage of human fatigue — the natural slowdown of attackers during multi-hour intrusions — erodes. An agentic loop does not tire, does not step away, and can iterate through failure conditions at consistent speed. This compresses the detection window and increases the pressure on automated response capabilities.
The 3AM operation itself is not novel — it traces lineage to Conti and Royal — but its affiliates appear to be early experimenters with AI tooling. That experimentation phase will not last long. As these techniques prove out, they will be codified and shared within affiliate networks, lowering the barrier for less-skilled operators to conduct sophisticated intrusions.
Shield53 Recommendations
Immediate Actions
- Audit for backdoor AD accounts — search for suspiciously named service accounts (e.g.,
library,svc_bkpmon, generic naming patterns) and validate their creation history and delegations. - Review cross-domain trust configurations — enumerate all trust relationships and remove any unauthorized two-way trusts established without change-control approval.
- Rotate Veeam stored credentials — if you run Veeam, assume credential stores are exposed and rotate service account passwords; restrict access to the Veeam database.
- Isolate unmanaged endpoints — enforce network segmentation so unmanaged or BYO devices cannot reach domain controllers, backup servers, or administrative shares.
Strategic Hardening
- Deploy EDR with automated containment — if an agentic attacker operates at machine speed, manual response is insufficient. Enable automated isolation on credential-dumping and LSASS-access detections.
- Implement LAPS or equivalent for local admin password randomization to blunt lateral movement via stolen credentials.
- Tamper-protect endpoint agents — both Sophos and Bitdefender were targeted for removal here. Ensure anti-tamper features are enabled and monitor for uninstallation attempts.
- Monitor for agentic behavioral patterns — SIEM rules flagging command sequences at suspiciously regular intervals, or iterative parameter variation on PowerShell tools, may catch AI-assisted intrusions that traditional IOC matching misses.
- Test and verify backup integrity — 3AM specifically deleted system-state backups. Ensure immutable or offline backup copies exist and have been validated through restore testing.
The takeaway is not that AI has arrived as a weapon — it is that AI is being integrated into existing ransomware playbooks incrementally, and the incremental phase is where defenders have the narrowest window to adapt before it becomes standard practice. Treat this incident as a leading indicator, not an outlier.
