# 3AM (ThreeAM) Ransomware Hybrid Human/AI-Assisted Attack on UK School Estate

> Bitdefender documents a 3AM (ThreeAM) ransomware affiliate intrusion against a UK school estate (47 systems) that combined human-directed strategy with LLM-assisted agentic command execution. The chain ran from Veeam credential theft through backdoor domain admin accounts and cross-domain trust creation to registry-staged exfiltration and Rust-based ThreeAM encryption on 19 September 2026.

- **Published:** 2026-11-03T18:19:36Z
- **Last reviewed:** 2026-11-04T01:11:49.093Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5168
- **ID:** TL-2026-5168
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** 3AM ransomware affiliate
- **Detections:** 9 (1 shown free below) · **IOCs:** 36 (3 shown free below)

## Description

Bitdefender Business Insights (Marius Baciu, published 2026-11-03) describes a ThreeAM ransomware-as-a-service affiliate intrusion against a UK public-sector school estate of 47 systems (about 21 servers, 8 domain controllers including one Windows Server 2012 R2 DC, 10 unsupported Windows 10 workstations and Windows 11 systems) spread across multiple separate Active Directory domains. The estate used Veeam for backups, Chrome on terminal servers, and Sophos and Bitdefender EDR. The initial access vector is unknown per the source. The source presents this as a single case, not a trend.

The operation followed a standard affiliate playbook. On 10-11 September 2026 the operator stole backup credentials using a modified public Veeam-Get-Creds.ps1 and queried the VeeamBackup database on the VEEAMSQL2016 instance. On 12-13 September they ran domain reconnaissance and proof-of-access probes (artifacts such as test123, psexec-ok, da_proof and a VEEAMPROBE scheduled task running as SYSTEM). On 14 September they dumped credentials with Mimikatz 2.2.0-20220919 renamed to names such as sysmon64.exe, svcstat.exe, syshealth.exe and random .tmp.exe files, dumped the SECURITY, SYSTEM and SAM hives, attempted an LSASS dump, and created the backdoor domain administrator accounts library and svc_bkpmon. On 15 September they staged data in the registry (HKLM\SOFTWARE\VC31, values FIN001-FIN040 holding base64 chunks, with a FINCOUNT counter) and exfiltrated it by HTTP POST to an unmanaged internal host's rcv.aspx endpoint (/rcv.aspx?f=fin.zip, with status messages to /rcv.aspx?f=status.txt). On 18 September (15:39-18:37 UTC) they built cross-domain connectivity with dnscmd conditional forwarders and netdom two-way trusts, verified with netdom trust /verify, and restarted Netlogon. On 19 September they attempted EDR removal with av_remove*.ps1 scripts, which anti-tampering blocked, then deployed the Rust-based ThreeAM encryptor (host.exe -k <victim_id> -s 15) at roughly 12-13 seconds per machine, deleting backups with wbadmin delete systemstatebackup -keepVersions:0 -quiet.

What distinguishes the case is its AI-assisted tradecraft. Bitdefender observed commands regenerated every 40-101 seconds regardless of complexity, Unix idioms in Windows PowerShell (2>/dev/null, escaped \$_), numbered script revisions instead of in-place edits (hop.ps1/hop2.ps1/hop3.ps1, av_remove 1-3, prx_go 1-3), self-labelling output markers (===TRUSTS===, == CONNECTIVITY ==), progress suppression, a Veeam REST API call using port 9392 with HTTP Basic auth where Veeam documents port 9419 with OAuth2, and LSASS parsing errors from incorrect delimiters. Bitdefender interprets these as an LLM-driven agentic command loop under human strategic direction. Recommended defenses: alert on domain trust creation and netdom trust execution; monitor access to backup databases and registry hive dumping; hunt for the probe artifacts; scope backup credentials per domain; keep immutable, isolated backup copies; restrict WMI, remote registry, scheduled tasks and ADMIN$ shares; block interpreters on workstations; and deploy endpoint agents on every system.

## MITRE ATT&CK

- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1003 OS Credential Dumping
- T1003.002 Security Account Manager
- T1059.001 PowerShell
- T1059.006 Python
- T1047 Windows Management Instrumentation
- T1136.002 Domain Account
- T1053.005 Scheduled Task
- T1484.002 Trust Modification
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1482 Domain Trust Discovery
- T1087.002 Domain Account
- T1021.002 SMB/Windows Admin Shares
- T1021.006 Windows Remote Management
- T1074.001 Local Data Staging
- T1490 Inhibit System Recovery
- T1078.002 Valid Accounts
- T1112 Modify Registry
- T1003.001 OS Credential Dumping
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**3AM Affiliate Veeam Backup Credential Theft via PowerShell — Exploitation Phase** (`TL-2026-5168-SPL-001`)

Detects PowerShell script-block activity that steals and decrypts Veeam Backup & Replication credentials: the modified public Veeam-Get-Creds.ps1 / veeam_pull.ps1 scripts, queries against the VeeamBackup database Credentials table with DPAPI/Unprotect decryption, use of the VEEAMSQL2016 instance, and the LLM-fingerprint Veeam REST call to /api/v1/credentials on port 9392. Backup credential theft on 10-11 September 2026 was the first confirmed stage of the 3AM (ThreeAM) intrusion against a UK school estate and enabled later domain-wide movement.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555, T1059.001
- **Data sources:** windows_powershell_scriptblock_4104, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=powershell sourcetype="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104 (ScriptBlockText="*Veeam*" OR ScriptBlockText="*VEEAMSQL2016*")
```3AM affiliate Veeam credential theft: modified Veeam-Get-Creds.ps1 / veeam_pull.ps1, VeeamBackup DB Credentials decryption, bogus REST call on port 9392```
| eval sb=lower(ScriptBlockText)
| eval tool_name=if(match(sb,"veeam-get-creds|veeam_pull"),1,0)
| eval db_decrypt=if(match(sb,"veeambackup") AND match(sb,"credentials") AND match(sb,"unprotect|protecteddata|dpapi"),1,0)
| eval rest_api_9392=if(match(sb,"9392") AND match(sb,"/api/v1/credentials"),1,0)
| eval veeam_sql_instance=if(match(sb,"veeamsql2016") AND match(sb,"invoke-sqlcmd|sqlconnection|select "),1,0)
| where tool_name=1 OR db_decrypt=1 OR rest_api_9392=1 OR veeam_sql_instance=1
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen max(tool_name) AS tool_name max(db_decrypt) AS db_decrypt max(rest_api_9392) AS rest_api_9392 max(veeam_sql_instance) AS veeam_sql_instance values(ScriptBlockText) AS script_blocks BY host, UserID
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let ps_events = union
    (DeviceProcessEvents
        | where Timestamp > ago(24h)
        | project Timestamp, DeviceName, Account = AccountName, Source = "process", Content = ProcessCommandLine),
    (DeviceEvents
        | where Timestamp > ago(24h) and ActionType == "PowerShellCommand"
        | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Source = "powershell_script_block", Content = tostring(parse_json(AdditionalFields).Command)),
    (DeviceFileEvents
        | where Timestamp > ago(24h) and FileName in~ ("Veeam-Get-Creds.ps1", "veeam_pull.ps1")
        | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Source = "file", Content = FolderPath);
ps_events
| where Content has_any ("Veeam-Get-Creds", "veeam_pull")
    or (Content has "VeeamBackup" and Content has "Credentials" and Content has_any ("Unprotect", "ProtectedData", "DPAPI"))
    or (Content has "9392" and Content has "/api/v1/credentials")
    or (Content has "VEEAMSQL2016" and Content has_any ("Invoke-Sqlcmd", "SqlConnection", "SELECT"))
| project Timestamp, DeviceName, Account, Source, Content
| order by Timestamp desc
```

### Sigma

```yaml
title: Veeam Backup Credential Theft via PowerShell (ThreeAM Affiliate)
id: 3f6a1c52-8b7e-4d1a-9c34-5e2b7a901d10
status: experimental
description: Detects PowerShell script blocks that extract and decrypt Veeam Backup & Replication stored credentials, as used by a ThreeAM affiliate (modified Veeam-Get-Creds.ps1, veeam_pull.ps1, VeeamBackup database Credentials table, VEEAMSQL2016 instance, and the LLM-error Veeam REST call on port 9392).
references:
    - https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack
    - https://github.com/bitdefender/malware-ioc/blob/master/2026_11-3am-iocs.csv
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.credential-access
    - attack.t1555
    - attack.execution
    - attack.t1059.001
logsource:
    category: ps_script
    product: windows
detection:
    selection_tool:
        ScriptBlockText|contains:
            - 'Veeam-Get-Creds'
            - 'veeam_pull'
    selection_db:
        ScriptBlockText|contains|all:
            - 'VeeamBackup'
            - 'Credentials'
    selection_decrypt:
        ScriptBlockText|contains:
            - 'Unprotect'
            - 'ProtectedData'
            - 'DPAPI'
    selection_api:
        ScriptBlockText|contains|all:
            - '9392'
            - '/api/v1/credentials'
    selection_sql_instance:
        ScriptBlockText|contains: 'VEEAMSQL2016'
    selection_sql_cmd:
        ScriptBlockText|contains:
            - 'Invoke-Sqlcmd'
            - 'SqlConnection'
    condition: selection_tool or selection_api or (selection_db and selection_decrypt) or (selection_sql_instance and selection_sql_cmd)
falsepositives:
    - Authorised Veeam credential audit or migration scripts run by backup administrators
    - Backup-health or documentation scripts that read the VeeamBackup database
level: high

```

**Known false positives:**

- Authorised Veeam credential audit or migration scripts run by backup administrators
- Backup-health or documentation scripts that legitimately read the VeeamBackup database

**Tuning notes:** Requires PowerShell Script Block Logging (EventCode 4104) forwarded to index=powershell; adjust the index name to your environment. Allow-list known Veeam server hosts and the backup service account by host/UserID after validation. The generic db_decrypt branch is the most likely to fire on admin tooling; the tool_name and rest_api_9392 branches are high fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Renamed Mimikatz and SAM/SECURITY/SYSTEM Hive Dumping — Credential Access (locked: unlock with TL Creds)
- 3AM Registry Data Staging ([indicator]) and rcv.aspx HTTP POST Exfiltration — Post-Exploitation (locked: unlock with TL Creds)
- Impacket-Style Remote Execution via WMI, ADMIN$ Redirection, WinRM and Remote SYSTEM Scheduled Tasks — Lateral Movement (locked: unlock with TL Creds)
- ThreeAM Proof-of-Access Probes and VEEAMPROBE / WindowsTempDiag Scheduled Tasks — Early Intrusion (locked: unlock with TL Creds)
- 3AM EDR Removal Scripts, Portable Python Tooling and LLM-Generated Script Artifacts — Defense Impairment (locked: unlock with TL Creds)
- ThreeAM Rust Encryptor ([indicator] -k -s 15) and wbadmin System State Backup Deletion — Impact (locked: unlock with TL Creds)
- 3AM Backdoor Domain Admin Accounts (library / svc_bkpmon) and Privileged Group Changes — Post-Exploitation (locked: unlock with TL Creds)
- 3AM Cross-Domain Trust Creation via netdom and dnscmd Conditional Forwarders — C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 36)

Defanged, TLP:CLEAR.

- Domain: `threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad[.]onion`
- File hash: `882f34f27292dd797fc022eeac28dfb070d408d310f4e9be20a2a0cb1e78620d`
- File hash: `4ed9b13ac7a4b0d937dbd3fbfa62c604`

Full set of 36 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop (Bitdefender, Marius Baciu)](https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack)
- [Bitdefender malware-ioc repository: 2026_11-3am-iocs.csv](https://github.com/bitdefender/malware-ioc/blob/master/2026_11-3am-iocs.csv)
- [WatchGuard Ransomware Tracker: ThreeAM](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/threeam)
- [3AM: New Ransomware Family Used As Fallback in Failed LockBit Attack (Symantec)](https://security.com/threat-intelligence/3am-ransomware-lockbit)
- [LockBit Affiliate Deploys New 3AM Ransomware in Recent Attack (SecurityWeek)](https://www.securityweek.com/lockbit-affiliate-deploys-new-3am-ransomware-in-recent-attack/)
- [A new ransomware family called 3AM appears in the threat landscape (Security Affairs)](https://securityaffairs.com/150784/malware/3am-ransomware.html)
- [Sophos: Three AM group ransomware tactics](https://www.sophos.com/en-us/content/three-am-group-ransomware-tactics)
- [Elastic: Potential Veeam Credential Access Command](https://www.elastic.co/guide/en/security/current/potential-veeam-credential-access-command.html)
- [sadshade/veeam-creds (public Veeam credential extraction script)](https://github.com/sadshade/veeam-creds)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5168