3AM Ransomware Blends Human and AI Operators

The intruders who moved through a UK school estate's network over ten days in September 2026 left behind a pattern of timestamps that didn't quite fit a human alone — and didn't quite fit a machine either. According to an investigation by Bitdefender, the 3AM ransomware group divided the hands-on work between a person at the keyboard and an AI agent, encrypting 37 machines along the way and building domain trusts to reach other schools.

The security firm described the incident as “the first case of this kind that we have documented in Europe.” The findings were published in a blog on November 3 and reported by Infosecurity Magazine.

A ten-day intrusion, rebuilt from logs

Bitdefender attributes the operation to a 3AM ransomware affiliate. The 3AM operation is a ransomware-as-a-service (RaaS) outfit whose Rust-based encryptor was first observed in February 2023, according to the researchers.

The timeline begins on September 10, 2026, though the researchers could not determine how the attacker first got into the school estate. What they could see was the next step: the intruders accessed credentials stored in the estate's backup infrastructure, then decrypted them using the Windows Data Protection API.

From there the activity ran through September 19. Across those ten days the attackers tested connections to other hosts, planted persistence, exfiltrated files, joined separate Active Directory domains, tried to strip endpoint detection and response tools, and finally encrypted machines.

The retry sequence that gave it away

The clearest tell came between September 12 and 13, when the threat actor tested connections to other hosts from a machine where SQL Server was the parent process. The attacker sent a sequence of commands to the target's Windows Management Instrumentation (WMI) service, authenticating with stolen administrator credentials. The output of each command was then read — by either a person or a model — who chose the next command and repeated the loop.

The timing was peculiar. A PowerShell command was first used, then re-run unchanged 41 seconds later. A single call was changed 49 seconds after that. Then, 47 seconds later, PowerShell was replaced with wmic, the older built-in command-line interface to WMI.

Bitdefender noted that the complete rewrite arriving as quickly as the minor edits before it indicates the commands were written by an AI agent. The next nine retries followed a similar pattern, with the delay before the next command landing between 40 and 101 seconds regardless of how large the change was.

“That split, longer time between tasks and shorter between retries, is what it looks like if a person is choosing the next step and a model is handling the retries,” the Bitdefender researchers wrote.

By contrast, the earlier commands leading into the retry sequence were simpler and spaced between two and 16 minutes apart — the pace of someone reading output and deciding what to do next.

Persistence, stolen files, a registry channel

On September 14, the attacker worked on persistence inside the compromised environments. That included running the credential-dumping tool Mimikatz and creating two backdoor domain-administrator accounts by separate routes.

The attackers then copied 40 financial-related files using the Windows robocopy tool and exfiltrated them to their command-and-control (C2) endpoint over HTTP POST. Bitdefender flagged the transport used for that channel as an unusual choice.

“The registry-as-transport channel is an unusual choice and a strong indicator to hunt for,” the researchers noted.

Building trusts across three domains

The most mechanical phase arrived on September 19. The attacker joined three separate Active Directory domains with two-way trusts and pushed the backdoor account's access across the estate inside a window of roughly three hours. Bitdefender called this segment the clearest example of the hybrid human-AI approach in the whole intrusion.

Joining an estate's separate domains is painstaking, repetitive configuration work: it has to be set up correctly on both sides, and one wrong detail stops everything. The attackers built the trusts, ran a series of diagnostic probes, and restarted the service that maintains the secure channel between domains. Bitdefender argued the hybrid model suits exactly this kind of task — repetition where the fix comes from a human reading the error.

The work paid off in reach: the attackers got to 50 machines from the unmanaged host. They then attempted to remove endpoint detection and response (EDR) tools, and finally decrypted 37 of the 50 machines they had accessed.

Why the split makes economic sense

Much of what Bitdefender observed is familiar ransomware tradecraft: backup credential theft, rogue domain administrators, trusts between domains, and abuse of built-in legitimate tooling. What differed was who did the hands-on work.

“What this attack does show is that the hybrid approach works, and we assess that it makes economic sense for attackers, with a person setting the goals and an [AI] model handling the mechanical work. We can expect hybrid attacks like this one to become more common in 2027,” the researchers said.

They described the division of labor as pragmatic: “The approach looks pragmatic: the model takes the mechanical, repetitive work, and nothing in it needed skill or spend that these attackers did not already have,” the researchers commented.

Bitdefender also noted that bringing a model into the loop changes what the traces of an intrusion look like — the cadence of commands becomes a signal in its own right.

What defenders are told to watch

Bitdefender's recommendations for defenders facing a similar playbook cover identity separation, backup protection, and reducing the surfaces attackers used to move. They are:

• Keep the administrative accounts of separate domains separate, and never keep privileged credentials for several domains in one place
• Treat backup infrastructure as a target, and review your backup strategy for malicious intent
• Restrict remote execution and administrative shares
• Block interpreters and shells on machines that never use them
• Put an endpoint agent on every machine

The stakes for schools and their networks

The incident shows what a hybrid operator model looks like when it is pointed at a shared estate rather than a single organization. The domain trusts that let the attackers expand from the unmanaged host toward other schools are the same connective tissue that lets a school estate operate as one — which is precisely why the researchers recommend keeping privileged credentials for separate domains apart. For institutions that run a single estate across many sites, that separation is a practical control, not a theoretical one.

The timing pattern Bitdefender documented suggests detection rules tuned to the rhythm of a human intruder may not catch a model-driven retry loop, and vice versa; this could mean defenders need to look at the mix of fast repetitive actions and slower decision points together rather than treating either as a standalone anomaly. The researchers' assessment that such attacks will become more common in 2027 points toward cost: if the mechanical work can be handed to a model, the barrier to running this kind of campaign drops for affiliates who already have the credentials and tooling. For schools and other organizations operating shared infrastructure, the defensive lesson is to close the routes the attackers used — backup access, standing domain-admin rights, and unnecessary interpreters — before a hybrid operator finds them.