A newly published Bitdefender investigation of a September ransomware intrusion shows how recovery infrastructure can become a source of attack credentials. In a UK school estate, a 3AM ransomware affiliate stole backup-system credentials, established rogue administrator accounts and created relationships between previously separate Active Directory domains before encryption spread across the environment.
For small businesses and government contractors, the practical question is not whether an attacker used AI. It is whether one compromised backup server or administrative identity can unlock several environments—and whether recovery remains possible after those identities are lost.
New research, not a new November attack
Bitdefender's report, published November 3, 2026, describes observed activity from September 10 through September 19. The researchers attribute the intrusion to a 3AM, also called ThreeAM, ransomware affiliate. They do not establish how the attacker first entered the network.
The attacker operated from an unmanaged internal host outside the researchers' endpoint visibility. According to the report, about 50 machines were reached from that host and about 37 were encrypted. Those are approximate observations from one investigation, not a measure of a wider campaign.
The important chain: recovery secrets became production access
The first recorded September activity targeted backup infrastructure. Bitdefender describes a modified public script reading stored credentials from backup-software databases on three servers and decrypting them using Windows Data Protection API functionality. This is evidence of post-compromise credential access, not proof of a new Veeam vulnerability or the initial entry mechanism.
The investigation also found credential-dumping activity and two rogue domain-administrator accounts. On September 18, the attacker created two-way trusts between three domains and pushed account access across the estate. A trust permits cross-domain authentication; it does not automatically grant authorization. The report documents separate access changes after the trust-building work.
The distinction matters during response. Removing an unauthorized trust alone does not remove administrator accounts, local permissions, scheduled tasks or other access already established on individual machines. Defenders need to reconstruct both the relationship changes and the authority granted through them.
On September 19, the affiliate deployed the ThreeAM encryptor. Bitdefender also observed deletion of Windows system-state backups. Backup infrastructure therefore appeared at both ends of the intrusion: first as a credential source, later as a recovery target.
What the AI evidence does—and does not—show
Bitdefender assesses that language-model generation of commands is strongly supported by their content. Repeated attempts, numbered script revisions and similar delays between differently sized changes led the researchers to consider a hybrid human-and-agent workflow.
That interpretation is not proof of an autonomous attacker. The researchers could not inspect the unmanaged source machine, identify a model or exclude a person copying commands and results between a chat interface and a shell. Their telemetry does not establish that no human participated. The report explicitly describes one case, not a trend.
Neither the encryptor nor the main intrusion techniques needed a novel AI capability. The documented chain relied largely on familiar Windows administration features and public tools. Response priorities should follow those verified behaviors rather than a speculative automation label.
Actions for lean security teams
- Map the authority stored in backup systems. Identify which production domains, servers and management services each backup account can reach. Separate accounts by environment and purpose; avoid storing broadly privileged credentials for multiple domains in one place. Plan changes with the backup owner so protection does not silently stop.
- Put trust and administrator changes under explicit control. Baseline existing domain trusts and privileged memberships. Alert on unexpected trust creation, new administrator accounts and permission expansion. Correlate changes with the originating host, account and approved change record.
- Constrain the remote-management paths. Limit WMI, WinRM, administrative SMB shares, remote registry and remote scheduled-task creation to approved management hosts where operationally possible. A legitimate Windows executable is not evidence of an authorized administrative session.
- Close endpoint-visibility gaps. Compare network and directory inventories with endpoint-agent coverage. Investigate unknown internal systems that initiate administrative connections. In this case, an unmanaged host was both an operational foothold and a major evidence limitation.
- Prove recovery is independent. Maintain immutable or offline recovery copies that production-domain administrators cannot delete. Test restoration using separately protected recovery access, not only the credentials that a ransomware operator could steal from production.
If suspicious changes are already present
Preserve directory, endpoint, backup-console and remote-administration evidence before cleanup, where feasible. Investigate credential-reading access to backup databases, unexpected exports of sensitive registry hives, new privileged accounts, trust modifications and remote task deployment as a connected sequence.
The report includes probe files, script names and source-authored indicators. Treat individual filenames or ordinary tools as investigation leads, not automatic malicious verdicts: context, account authority, process ancestry and timing determine their meaning. Coordinate isolation and credential recovery from a known-clean administrative environment, and examine every domain touched by the suspect identities.
Bulwark assessment
The most consequential finding is the expansion of an administrative blast radius. Separate domains did not remain separate security boundaries once the attacker possessed enough authority to build trusts and distribute access. A backup design that survives disk failure may still fail against an adversary who steals its credentials.
For organizations supporting government customers or operating multiple business units, test a concrete scenario: if the production domain and the main backup administrator are compromised together, can the team still obtain trustworthy recovery copies and restore a clean environment? That answer has more immediate defensive value than deciding whether each observed command was typed by a person or generated by a model.
Original source and limits
Bitdefender: 3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop is the primary investigation behind this analysis. The incident's entry vector, the exact AI operating mechanism and any broader campaign scope remain unestablished in the reviewed evidence. The UK is the victim location, not an actor-country attribution. This article adds defensive analysis; it does not independently reproduce the researchers' forensics.