What Bitdefender found
Bitdefender’s investigation, published on November 3, attributes the intrusion to a 3AM ransomware affiliate. The attack unfolded from September 10–19, 2026, and resulted in the actors encrypting 37 machines after reaching roughly 50 machines from an unmanaged host. Researchers said the affiliate used a hybrid human–AI model during the post-compromise phase: a person set goals and an AI model handled repetitive, mechanical steps.
The report notes 3AM operates as a ransomware-as-a-service (RaaS) and that its Rust-based encryptor was first observed in February 2023. Bitdefender was unable to determine the initial access vector; the first recorded activity on September 10 involved access to credentials stored in the estate’s backup infrastructure and decrypting them with the Windows Data Protection API.
How the hybrid attack operated (September 12–19)
Between September 12 and 13 the attackers tested connections to other hosts from a machine where SQL Server was the parent process. They issued sequences of commands to Windows Management Instrumentation (WMI), authenticating with stolen administrator credentials. Bitdefender observed an alternating cadence: short delays of roughly 40–101 seconds between retries and longer, multi-minute pauses between task changes.
Command patterns included an initial PowerShell command re-run 41 seconds later, a small change 49 seconds after that, then a full rewrite within 47 seconds; later, PowerShell was replaced with wmic. Bitdefender interprets the fast, consistent retry cadence as the work of an AI model and the longer pauses between tasks as a human reading outputs and choosing the next step.
On September 14 the actor ran Mimikatz for credential dumping and created two backdoor domain-administrator accounts by separate routes. The attackers copied 40 financial-related files with robocopy and exfiltrated them to a command-and-control endpoint using HTTP POST. Bitdefender highlighted a registry-as-transport channel used by the adversary as “an unusual choice and a strong indicator to hunt for.”
On September 19 the actor joined three separate Active Directory domains with two-way trusts and pushed the backdoor account’s access across the estate in an approximately three-hour window. Bitdefender described this domain-joining and trust-building work as “highly mechanical” and a clear example of the hybrid approach: the model performed repetitive configuration and a human stepped in when diagnostics required interpretation.
Before encrypting 37 machines, the actor attempted to remove endpoint detection and response (EDR) tools.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTechnical hallmarks defenders should note
- Backup infrastructure credentials were targeted and decrypted via the Windows Data Protection API.
- Use of built-in tooling: PowerShell, wmic, robocopy, and WMI for lateral movement and data collection.
- Credential dumping with Mimikatz and creation of multiple backdoor domain-admin accounts.
- Active Directory two-way trusts created between three domains, expanding access across the estate.
- Data exfiltration via HTTP POST and a registry-as-transport channel—an unusual telemetry signature flagged by Bitdefender.
Bitdefender’s practical recommendations for defenders
Bitdefender stressed that while the attack used typical ransomware playbook elements, the hybrid human–AI split changes traces and operational tempo. The company offered specific guidance:
- Keep administrative accounts for separate domains separate, and never store privileged credentials for several domains in one place.
- Treat backup infrastructure as a target and review backup strategy for malicious intent.
- Restrict remote execution and administrative shares.
- Block interpreters and shells on machines that never use them.
- Put an endpoint agent on every machine.
What this means for school IT teams, security defenders, and procurement leaders
- School IT teams: the attack reached across a school estate by creating domain trusts; local administrators should separate domain credentials and review any backups or credential stores for exposure.
- Security defenders: the mixed cadence of rapid retries and longer decision pauses is a forensic marker to watch for, and the unusual registry-as-transport channel is a hunting indicator.
- Procurement leaders: Bitdefender’s findings underscore the need to ensure endpoint agents are deployed broadly and to vet backup solutions and credential management practices as part of procurement and contract conditions.
Bitdefender concluded the hybrid model “makes economic sense for attackers” because it lets a human set objectives while an AI model handles repetitive work, and the company assessed such hybrid attacks are likely to become more common in 2027. One concrete gap remains: investigators could not determine how the affiliate initially gained access to the estate. That unresolved vector will be central to preventing similar hybrid operations going forward.
