3AM encrypted about 37 UK school machines in September, Bitdefender says

A 3AM ransomware affiliate encrypted about 37 machines at a UK school estate after reaching nearly 50 from an unmanaged computer, cybersecurity company Bitdefender said. Ransomware encrypts files to prevent their normal use.

BleepingComputer described Bitdefender’s findings on 3 November 2026. The malicious activity ran from 10–19 September; Bitdefender could not establish how the attacker first gained access.

How the attacker expanded access

Bitdefender said the attacker used a modified publicly available tool to extract and decrypt credentials stored on three Veeam backup servers. The attacker also copied a Chrome credential database and used tools to extract credentials and dump computer memory.

The attacker mapped relationships between network domains, searched folders containing sign-in scripts for references to other schools, and created backdoor domain-administrator accounts named “library” and “svc_bkpmon” to retain access.

After stealing financial data, the attacker set up two-way trusts between three previously separate Active Directory domains. A domain groups accounts and computers under shared administration; a two-way trust allows access to be authorized in both directions. Changing those relationships expanded the attacker’s reach across the school networks, Bitdefender said.

In the final stage, the attacker tried to remove Sophos and Bitdefender protection, delete system-state backups used to restore system configuration, and deploy 3AM’s Rust-based encryption software.

Why Bitdefender suspects SI assistance

Bitdefender’s suspicion rests on the repeated, slightly modified commands and their roughly regular timing. Researchers said the behavior resembled an automated loop in which a system issues a command, receives a result and adjusts its next instruction.

Without access to the attacker’s machine, researchers could not identify a language model or determine whether one ran on that computer or remotely. Bitdefender said a person could have copied and pasted instructions and results between the malicious software and a model, leaving autonomous operation unestablished.