3AM Ransomware Affiliate Breaches UK Schools in Suspected Hybrid AI Intrusion
A 3AM (ThreeAM) ransomware affiliate breached a UK school estate, stole credentials from backup servers and domain controllers, built two-way Active Directory trusts and encrypted about 37 machines. Command content strongly indicates language-model authorship.
Summary
3AM, also tracked as ThreeAM, is a Rust-based ransomware-as-a-service operation active since February 2023 that reportedly began as a fallback payload for failed LockBit deployments and runs a double-extortion model, encrypting files with the .threeamtime extension, wiping shadow copies and leaking stolen data.
In its latest activity, an affiliate breached a UK school estate through an unknown access vector, stole credentials from backup servers and domain controllers, and created backdoor domain administrators. The operator then built two-way trusts across separate Active Directory domains, exfiltrated finance data over an internal C2 channel and encrypted about 37 machines. Command content strongly indicates language-model authorship, and retry timing is consistent with a human operator directing an AI agentic loop.
Attack Details
3AM, also tracked as ThreeAM, is a Rust-based ransomware run as a ransomware-as-a-service operation in which the core group leases its encryptor to affiliates. First seen in February 2023, it reportedly began as a fallback payload for failed LockBit deployments, and its Russian-speaking operators have been tied to LockBit and BlackSuit. The group steals data, encrypts files with the .threeamtime extension, wipes shadow copies and lists victims on a dark web leak site.
In September 2026, a 3AM affiliate breached a UK school estate of 47 systems spread across several unconnected Active Directory domains via an unknown access vector. Using Impacket-style remote execution, the operator extracted and DPAPI-decrypted credentials from Veeam databases on three backup servers, copied the Chrome saved-password store, exported the SECURITY and SYSTEM hives, ran Mimikatz renamed as sysmon64.exe and created the backdoor domain administrators library and svc_bkpmon.
Reconnaissance was sector-specific, with SYSVOL searched for other schools' names and subnets. The affiliate then built two-way trusts between three domains using dnscmd and netdom and pushed the backdoor account's access to about 40 machines through scheduled tasks. Finance files were staged as Base64 registry values, mirrored with robocopy, zipped and posted to an unmanaged internal host acting as C2. After anti-tampering blocked EDR removal, the host.exe encryptor hit about 37 machines in under half an hour while deleting system-state backups.
The intrusion stands out for its suspected hybrid human and AI operation. Command content strongly indicates language-model authorship, including a Veeam REST call with the wrong port and authentication method, a broken LSASS-dump parser, Unix shell habits in Windows commands, confirmation artifacts such as da_proof.txt and numbered script revisions. Retries arrived every 40 to 101 seconds regardless of change size while new tasks took minutes, consistent with a human setting goals and an agentic loop handling retries, though manual relaying to a chatbot cannot be excluded.
The toolkit is not novel, relying on built-in Windows binaries, public tools and a commodity encryptor. AI involvement changes the traces rather than the playbook, producing repetitive and noisy activity that the controls used against conventional ransomware can still stop.
Recommendations
- 01
Remove Rogue Domain Trusts and Backdoor Admins
Enumerate every domain trust with
nltest /domain_trustsornetdom, remove any trust that lacks an approved change record, and audit Domain Admins and Enterprise Admins in every domain for unexpected members such aslibraryandsvc_bkpmon. - 02
Rotate Credentials Exposed Through Backup Platforms
Treat every credential stored in Veeam configuration databases, every domain administrator password and saved browser passwords on terminal servers as compromised, rotate them, reset the KRBTGT account twice, and scope backup service accounts to a single domain.
- 03
Alert on Domain Trust Creation
Raise high-priority alerts for Windows Event ID
4706,netdom trust /addanddnscmd /zoneadd /forwarderexecutions, since a new inter-domain trust is a rare change in a healthy estate. - 04
Detect Hive Exports and LSASS Access
Alert on
reg saveof the SAM, SECURITY or SYSTEM hives,rundll32calls tocomsvcs.dllMiniDump and remote winreg access from non-administrative hosts, and enable LSA protection and Credential Guard to block credential theft from memory. - 05
Hunt for Agentic Loop Artifacts
Search hosts for probe and confirmation artifacts such as
da_proof.txt,psx_mark.txt,task_probe.txtand theVEEAMPROBEtask, numbered script revisions such asav_remove2.ps1, timestamped output files written to ADMIN$, and bursts of near-identical commands repeated at 40 to 100 second intervals. - 06
Monitor the Registry as a Data Channel
Alert on large Base64 string values written under
HKLM\SOFTWARE, includingVC31,FIN001toFIN040andFINCOUNT, and on remote registry writes that originate from unexpected hosts. - 07
Restrict Remote Execution Paths
Limit WMI, WinRM, remote registry, remote scheduled-task creation and ADMIN$ or C$ access to designated management hosts, and disable the RemoteRegistry service where it is not required.
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| Filenames | av_remove3.ps1grant_lib.ps1hop2.ps1hop3.ps1crackw.pysvcstat.exercv.aspxwmi_test.txt |
| File Paths | C:\Windows\Temp\1\host.exeC:\Windows\Temp\sysmon64.exeC:\Windows\Temp\av_remove.ps1C:\Windows\Temp\av_remove2.ps1C:\Windows\Temp\svc_data.txtC:\Windows\Temp\svc_test.ps1C:\Windows\Temp\prx_go.cmdC:\Windows\Temp\prx.txtC:\Windows\Temp\diag_member.batC:\Windows\Temp\diag_nl.batC:\Windows\Temp\lmhosts_test.batC:\Windows\Temp\wb_probe.batC:\Windows\Temp\nl_restart.batC:\Windows\Temp\da_proof.txtC:\Windows\Temp\task_probe.txtC:\Windows\Temp\psx_mark.txtC:\Windows\Temp\mimi_run.txtC:\Windows\Temp\mimi.logC:\Windows\Temp\ls.dmpC:\Windows\Temp\sec.saveC:\Windows\Temp\sys.saveC:\Windows\Temp\m.zipC:\Windows\Temp\fin.zipC:\Windows\Temp\rst\finance_mirror |
| URL | hxxps[:]//github[.]com/gentilkiwi/mimikatz/releases/download/2[.]2[.]0-20220919/mimikatz_trunk[.]zip |
| Registry Keys | HKLM\SOFTWARE\VC31HKLM\SOFTWARE\FIN001-FIN040HKLM\SOFTWARE\FINCOUNT |
| Scheduled Task | VEEAMPROBEWindowsTempDiag |
| Username | librarysvc_bkpmon |
| File Extension | .threeamtime |
| Recent Breaches | https://www.fleetworksinc.comhttps://www.stjames.wa.edu.auhttps://www.bhn-expertise.comhttps://www.coosalud.comhttps://www.midwestbit.comhttps://www.apexus.comhttps://www.safescaffolding.nethttps://www.pistonespersan.com.arhttps://www.newmantractor.comhttps://www.wmdn.nethttps://www.mecasem.orghttps://www.clubonecasino.comhttps://www.tws-tac.nethttps://www.guardianbarrierservices.comhttps://www.acemacon.orghttps://www.mgrlaw.comhttps://www.hoplongtech.comhttps://www.agroexportavocados.comhttps://www.amc.org.au |
MITRE ATT&CK TTPs
T1059Command and Scripting InterpreterT1059.001PowerShellT1059.003Windows Command ShellT1059.006PythonT1047Windows Management InstrumentationT1053Scheduled Task/JobT1053.005Scheduled TaskT1569System ServicesT1569.002Service ExecutionT1136Create AccountT1136.002Domain AccountT1098Account ManipulationT1098.007Additional Local or Domain GroupsT1078Valid AccountsT1078.002Domain AccountsT1484Domain or Tenant Policy ModificationT1484.002Trust ModificationT1562Impair DefensesT1562.001Disable or Modify ToolsT1562.004Disable or Modify System FirewallT1036MasqueradingT1036.005Match Legitimate Resource Name or LocationT1036.010Masquerade Account NameT1112Modify RegistryT1027Obfuscated Files or InformationT1027.010Command ObfuscationT1140Deobfuscate/Decode Files or InformationT1218System Binary Proxy ExecutionT1218.011Rundll32T1622Debugger EvasionT1480Execution GuardrailsT1555Credentials from Password StoresT1555.003Credentials from Web BrowsersT1003OS Credential DumpingT1003.001LSASS MemoryT1003.002Security Account ManagerT1003.004LSA SecretsT1003.005Cached Domain CredentialsT1482Domain Trust DiscoveryT1069Permission GroupsT1069.002Domain GroupsT1033System Owner/User DiscoveryT1007System Service DiscoveryT1518Software DiscoveryT1046Network Service DiscoveryT1135Network Share DiscoveryT1083File and Directory DiscoveryT1021Remote ServicesT1021.002SMB/Windows Admin SharesT1021.006Windows Remote ManagementT1570Lateral Tool TransferT1039Data from Network Shared DriveT1074Data StagedT1074.001Local Data StagingT1074.002Remote Data StagingT1560Archive Collected DataT1105Ingress Tool TransferT1071Application Layer ProtocolT1071.001Web ProtocolsT1041Exfiltration Over C2 ChannelT1486Data Encrypted for ImpactT1490Inhibit System RecoveryT1657Financial TheftReferences & Patch Links
References
- https://www.bitdefender.com/en-gb/blog/businessinsights/3am-ransomware-hybrid-ai-attack
- https://www.tripwire.com/state-of-security/3am-ransomware-what-you-need-know
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)