3AM (ThreeAM) Ransomware Hybrid Human/AI-Assisted Attack on UK School Estate

Key facts for 3AM hybrid AI intrusion

Detection coverage for 3AM hybrid AI intrusion

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5168 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: 3AM Affiliate Veeam Backup Credential Theft via PowerShell — Exploitation Phase

Detects PowerShell script-block activity that steals and decrypts Veeam Backup & Replication credentials: the modified public Veeam-Get-Creds.ps1 / veeam_pull.ps1 scripts, queries against the VeeamBackup database Credentials table with DPAPI/Unprotect decryption, use of the VEEAMSQL2016 instance, and the LLM-fingerprint Veeam REST call to /api/v1/credentials on port 9392. Backup credential theft on 10-11 September 2026 was the first confirmed stage of the 3AM (ThreeAM) intrusion against a UK school estate and enabled later domain-wide movement.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555, T1059.001
• Data sources: windows_powershell_scriptblock_4104, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=powershell sourcetype="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104 (ScriptBlockText="*Veeam*" OR ScriptBlockText="*VEEAMSQL2016*")
```3AM affiliate Veeam credential theft: modified Veeam-Get-Creds.ps1 / veeam_pull.ps1, VeeamBackup DB Credentials decryption, bogus REST call on port 9392```
| eval sb=lower(ScriptBlockText)
| eval tool_name=if(match(sb,"veeam-get-creds|veeam_pull"),1,0)
| eval db_decrypt=if(match(sb,"veeambackup") AND match(sb,"credentials") AND match(sb,"unprotect|protecteddata|dpapi"),1,0)
| eval rest_api_9392=if(match(sb,"9392") AND match(sb,"/api/v1/credentials"),1,0)
| eval veeam_sql_instance=if(match(sb,"veeamsql2016") AND match(sb,"invoke-sqlcmd|sqlconnection|select "),1,0)
| where tool_name=1 OR db_decrypt=1 OR rest_api_9392=1 OR veeam_sql_instance=1
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen max(tool_name) AS tool_name max(db_decrypt) AS db_decrypt max(rest_api_9392) AS rest_api_9392 max(veeam_sql_instance) AS veeam_sql_instance values(ScriptBlockText) AS script_blocks BY host, UserID
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let ps_events = union
    (DeviceProcessEvents
        | where Timestamp > ago(24h)
        | project Timestamp, DeviceName, Account = AccountName, Source = "process", Content = ProcessCommandLine),
    (DeviceEvents
        | where Timestamp > ago(24h) and ActionType == "PowerShellCommand"
        | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Source = "powershell_script_block", Content = tostring(parse_json(AdditionalFields).Command)),
    (DeviceFileEvents
        | where Timestamp > ago(24h) and FileName in~ ("Veeam-Get-Creds.ps1", "veeam_pull.ps1")
        | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Source = "file", Content = FolderPath);
ps_events
| where Content has_any ("Veeam-Get-Creds", "veeam_pull")
    or (Content has "VeeamBackup" and Content has "Credentials" and Content has_any ("Unprotect", "ProtectedData", "DPAPI"))
    or (Content has "9392" and Content has "/api/v1/credentials")
    or (Content has "VEEAMSQL2016" and Content has_any ("Invoke-Sqlcmd", "SqlConnection", "SELECT"))
| project Timestamp, DeviceName, Account, Source, Content
| order by Timestamp desc

Sigma

title: Veeam Backup Credential Theft via PowerShell (ThreeAM Affiliate)
id: 3f6a1c52-8b7e-4d1a-9c34-5e2b7a901d10
status: experimental
description: Detects PowerShell script blocks that extract and decrypt Veeam Backup & Replication stored credentials, as used by a ThreeAM affiliate (modified Veeam-Get-Creds.ps1, veeam_pull.ps1, VeeamBackup database Credentials table, VEEAMSQL2016 instance, and the LLM-error Veeam REST call on port 9392).
references:
    - https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack
    - https://github.com/bitdefender/malware-ioc/blob/master/2026_11-3am-iocs.csv
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.credential-access
    - attack.t1555
    - attack.execution
    - attack.t1059.001
logsource:
    category: ps_script
    product: windows
detection:
    selection_tool:
        ScriptBlockText|contains:
            - 'Veeam-Get-Creds'
            - 'veeam_pull'
    selection_db:
        ScriptBlockText|contains|all:
            - 'VeeamBackup'
            - 'Credentials'
    selection_decrypt:
        ScriptBlockText|contains:
            - 'Unprotect'
            - 'ProtectedData'
            - 'DPAPI'
    selection_api:
        ScriptBlockText|contains|all:
            - '9392'
            - '/api/v1/credentials'
    selection_sql_instance:
        ScriptBlockText|contains: 'VEEAMSQL2016'
    selection_sql_cmd:
        ScriptBlockText|contains:
            - 'Invoke-Sqlcmd'
            - 'SqlConnection'
    condition: selection_tool or selection_api or (selection_db and selection_decrypt) or (selection_sql_instance and selection_sql_cmd)
falsepositives:
    - Authorised Veeam credential audit or migration scripts run by backup administrators
    - Backup-health or documentation scripts that read the VeeamBackup database
level: high

Known false positives:

• Authorised Veeam credential audit or migration scripts run by backup administrators
• Backup-health or documentation scripts that legitimately read the VeeamBackup database

Tuning notes: Requires PowerShell Script Block Logging (EventCode 4104) forwarded to index=powershell; adjust the index name to your environment. Allow-list known Veeam server hosts and the backup service account by host/UserID after validation. The generic db_decrypt branch is the most likely to fire on admin tooling; the tool_name and rest_api_9392 branches are high fidelity.

• 🔒 Renamed Mimikatz and SAM/SECURITY/SYSTEM Hive Dumping — Credential Access · unlock with TL Creds
• 🔒 3AM Registry Data Staging ([indicator]) and rcv.aspx HTTP POST Exfiltration — Post-Exploitation · unlock with TL Creds
• 🔒 Impacket-Style Remote Execution via WMI, ADMIN$ Redirection, WinRM and Remote SYSTEM Scheduled Tasks — Lateral Movement · unlock with TL Creds
• 🔒 ThreeAM Proof-of-Access Probes and VEEAMPROBE / WindowsTempDiag Scheduled Tasks — Early Intrusion · unlock with TL Creds
• 🔒 3AM EDR Removal Scripts, Portable Python Tooling and LLM-Generated Script Artifacts — Defense Impairment · unlock with TL Creds
• 🔒 ThreeAM Rust Encryptor (host.exe -k -s 15) and wbadmin System State Backup Deletion — Impact · unlock with TL Creds
• 🔒 3AM Backdoor Domain Admin Accounts (library / svc_bkpmon) and Privileged Group Changes — Post-Exploitation · unlock with TL Creds
• 🔒 3AM Cross-Domain Trust Creation via netdom and dnscmd Conditional Forwarders — C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise for 3AM hybrid AI intrusion

As of 2026-11-03, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5168.

Sample indicators (3 of 26)

• Domain: threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad[.]onion
• File hash: 882f34f27292dd797fc022eeac28dfb070d408d310f4e9be20a2a0cb1e78620d
• File hash: 4ed9b13ac7a4b0d937dbd3fbfa62c604

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

How 3AM hybrid AI intrusion works

Bitdefender Business Insights (Marius Baciu, published 2026-11-03) describes a ThreeAM ransomware-as-a-service affiliate intrusion against a UK public-sector school estate of 47 systems (about 21 servers, 8 domain controllers including one Windows Server 2012 R2 DC, 10 unsupported Windows 10 workstations and Windows 11 systems) spread across multiple separate Active Directory domains. The estate used Veeam for backups, Chrome on terminal servers, and Sophos and Bitdefender EDR. The initial access vector is unknown per the source. The source presents this as a single case, not a trend.

The operation followed a standard affiliate playbook. On 10-11 September 2026 the operator stole backup credentials using a modified public Veeam-Get-Creds.ps1 and queried the VeeamBackup database on the VEEAMSQL2016 instance. On 12-13 September they ran domain reconnaissance and proof-of-access probes (artifacts such as test123, psexec-ok, da_proof and a VEEAMPROBE scheduled task running as SYSTEM). On 14 September they dumped credentials with Mimikatz 2.2.0-20220919 renamed to names such as sysmon64.exe, svcstat.exe, syshealth.exe and random .tmp.exe files, dumped the SECURITY, SYSTEM and SAM hives, attempted an LSASS dump, and created the backdoor domain administrator accounts library and svc_bkpmon. On 15 September they staged data in the registry (HKLM\SOFTWARE\VC31, values FIN001-FIN040 holding base64 chunks, with a FINCOUNT counter) and exfiltrated it by HTTP POST to an unmanaged internal host's rcv.aspx endpoint (/rcv.aspx?f=fin.zip, with status messages to /rcv.aspx?f=status.txt). On 18 September (15:39-18:37 UTC) they built cross-domain connectivity with dnscmd conditional forwarders and netdom two-way trusts, verified with netdom trust /verify, and restarted Netlogon. On 19 September they attempted EDR removal with av_remove*.ps1 scripts, which anti-tampering blocked, then deployed the Rust-based ThreeAM encryptor (host.exe -k <victim_id> -s 15) at roughly 12-13 seconds per machine, deleting backups with wbadmin delete systemstatebackup -keepVersions:0 -quiet.

What distinguishes the case is its AI-assisted tradecraft. Bitdefender observed commands regenerated every 40-101 seconds regardless of complexity, Unix idioms in Windows PowerShell (2>/dev/null, escaped \$_), numbered script revisions instead of in-place edits (hop.ps1/hop2.ps1/hop3.ps1, av_remove 1-3, prx_go 1-3), self-labelling output markers (===TRUSTS===, == CONNECTIVITY ==), progress suppression, a Veeam REST API call using port 9392 with HTTP Basic auth where Veeam documents port 9419 with OAuth2, and LSASS parsing errors from incorrect delimiters. Bitdefender interprets these as an LLM-driven agentic command loop under human strategic direction. Recommended defenses: alert on domain trust creation and netdom trust execution; monitor access to backup databases and registry hive dumping; hunt for the probe artifacts; scope backup credentials per domain; keep immutable, isolated backup copies; restrict WMI, remote registry, scheduled tasks and ADMIN$ shares; block interpreters on workstations; and deploy endpoint agents on every system.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1003.002 Security Account Manager; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1021.006 Windows Remote Management

Defense Evasion

T1036 Masquerading

Execution

T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.006 Python

Persistence

T1053.005 Scheduled Task; T1136.002 Domain Account

Collection

T1074.001 Local Data Staging

Discovery

T1087.002 Domain Account; T1482 Domain Trust Discovery

Privilege Escalation

T1484.002 Trust Modification

Impact

T1490 Inhibit System Recovery

Defense Impairment

T1685 Disable or Modify Tools

Remediation for 3AM hybrid AI intrusion

Immediate actions

• Alert on domain trust creation and netdom trust / dnscmd /zoneadd execution
• Hunt for probe artifacts: test123, psexec-ok, da_proof, VEEAMPROBE and WindowsTempDiag scheduled tasks
• Audit domain admin groups for unexpected accounts such as library and svc_bkpmon
• Hunt for HKLM\SOFTWARE\VC31 and FIN001-FIN040 registry values and rcv.aspx POST traffic
• Isolate and verify immutable backup copies before restoring

Workarounds

• Restrict WMI, remote registry, scheduled-task creation and ADMIN$ shares between hosts and domains
• Isolate backup infrastructure from production domains

Longer-term hardening

• Scope Veeam and backup service credentials per domain
• Monitor access to the VeeamBackup database and registry hive dumping (SECURITY, SYSTEM, SAM)
• Deploy endpoint agents on all systems and keep EDR anti-tampering enabled
• Block interpreters (PowerShell, Python) on workstations where not required
• Replace unsupported Windows 10 workstations and the Windows Server 2012 R2 domain controller

Affected and fixed versions

• Microsoft — Windows Server / Active Directory (multi-domain environments)
  Vulnerable versions: Windows Server 2012 R2 domain controller; Windows Server domain controllers and member servers; Windows 10 (unsupported); Windows 11
• Veeam — Veeam Backup & Replication (credential store in VeeamBackup database)
  Vulnerable versions: Instance VEEAMSQL2016 targeted; no vulnerable version identified

Timeline of 3AM hybrid AI intrusion

• 2023-09-13 Symantec publicly documents the locked-ioc-26 Rust-based ransomware family, first seen as a fallback after a failed LockBit deployment.
• 2026-01-23 Restricted Admin mode was enabled on four machines in the victim estate (relationship to the incident not confirmed by Bitdefender).
• 2026-09-10 10-11 September: operator steals backup credentials using a modified locked-ioc-12 and queries the VeeamBackup database on VEEAMSQL2016.
• 2026-09-12 12-13 September: domain reconnaissance and proof-of-access probes (test123, psexec-ok, da_proof, VEEAMPROBE scheduled task running as SYSTEM).
• 2026-09-14 Renamed locked-ioc-24 2.2.0-20220919 run; SECURITY/SYSTEM/SAM hives dumped; backdoor domain admin accounts locked-ioc-25 and locked-ioc-21 created.
• 2026-09-15 Data collected into registry (locked-ioc-15, FIN001-FIN040) and exfiltrated via HTTP POST to locked-ioc-13 on an unmanaged internal host.
• 2026-09-18 Between 15:39 and 18:37 UTC the operator creates conditional forwarders and two-way domain trusts with netdom and restarts Netlogon to extend reach across school domains.
• 2026-09-19 EDR removal attempts (blocked by anti-tampering), backup deletion with wbadmin, and locked-ioc-26 host.exe encryption deployed at roughly 12-13 seconds per machine across the estate.
• 2026-11-03 Bitdefender publishes the analysis and releases IOCs in its malware-ioc GitHub repository (2026_11-3am-iocs.csv).

Sources cited for 3AM hybrid AI intrusion

• WatchGuard Ransomware Tracker: ThreeAM watchguard.com · Research
• 3AM: New Ransomware Family Used As Fallback in Failed LockBit Attack (Symantec) security.com · Vendor report · 2023-09-13
• Sophos: Three AM group ransomware tactics Sophos · Vendor report
• Elastic: Potential Veeam Credential Access Command elastic.co · Research
• Bitdefender malware-ioc repository: 2026_11-3am-iocs.csv GitHub · Code repository · 2026-11-03
• sadshade/veeam-creds (public Veeam credential extraction script) GitHub · Code repository
• 3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop (Bitdefender, Marius Baciu) bitdefender.com · Blog · 2026-11-03
• LockBit Affiliate Deploys New 3AM Ransomware in Recent Attack (SecurityWeek) SecurityWeek · News
• A new ransomware family called 3AM appears in the threat landscape (Security Affairs) securityaffairs.com · News

More in ransomware

• Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment
• HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)
• NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)
• Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)
• Ransomware Targeting of Small and Medium-Sized Businesses: Credential Theft, Unpatched Edge Devices, BYOVD and Backup Targeting