Bitdefender’s write-up of a 3AM ransomware intrusion at a UK school estate describes the first hybrid human and AI-driven attack the company has documented in Europe. I read it as a case for alerting on rare configuration changes in Active Directory, because those are what the attacker could not hide.
The research post, published on 3 November by Marius Baciu of Bitdefender, covers activity from 10 to 19 September 2026. A 3AM ransomware affiliate stole backup credentials, created two rogue domain administrator accounts, joined three separate Active Directory domains with two-way trusts, tried to remove endpoint detection tools and then encrypted about 37 of the roughly 50 machines it reached. Bitdefender says initial access is unknown.
What made the case different
The unusual part was timing. On 13 September the attacker ran a PowerShell command, re-ran it unchanged 41 seconds later, changed one call 49 seconds after that, and 47 seconds later abandoned PowerShell for wmic. Bitdefender notes that the complete rewrite arrived as fast as the minor edits, and across nine retries the delay ran from 40 to 101 seconds whatever the size of the change. Between tasks the gaps were minutes. Bitdefender reads that as a person choosing the next step and a model handling the retries.
The company is careful about what it can prove. It could not access the machine the attacker worked from, so it cannot say which model was used, whether it ran locally, or whether a person pasted instructions and results between a shell and a chat window. Its own summary: “We present the hybrid reading as the working model defenders should plan around, not as an established fact.”
The strongest objection
The objection I take most seriously is that tempo changes everything. If a model can rewrite a failing command in under a minute, the argument goes, detections tuned to human pace are obsolete, and defenders need AI-specific tooling to keep up. Bitdefender expects more of these attacks, writing that “we can expect hybrid attacks like this one to become more common in 2027,” and our own reporting on the NCSC’s warning that UK infrastructure should brace for AI-powered ransomware by 2028 points the same way.
Why I do not buy the tooling conclusion
Bitdefender’s own findings undercut it. The attack “was not fast: even its quickest retries took 40 seconds or more.” The company calls it “one case, an anecdote, and not a trend,” and says that “most intrusions we investigate still look the way they did before language models.” The tradecraft was ordinary: backup credential theft, rogue domain admins, trusts between domains, built-in Windows tools and a commodity encryptor. Baciu’s lesson from the case is that “an AI-enabled attack does not have to be novel or creative to work,” because it uses techniques defenders already know.
That last point is the one to act on. The step Bitdefender calls the clearest example of the hybrid approach, building trusts between three domains, is also the step a defender can see. Baciu writes that it is “work a defender can see, because a new trust between domains is a rare change and cheap to alert on.” The trusts went in over a roughly three-hour window on 18 September, and about 50 machines were reached from a host that ran no Bitdefender agent.
The detection list I would build from this case is made of changes that almost never happen in a healthy estate, with no model fingerprinting on it:
- A new trust relationship between domains.
- A new account added to a domain admin group, especially two in a short span by separate routes. Bitdefender’s two backdoor accounts, library and svc_bkpmon, were created by separate routes and carry names chosen to blend into a school’s account list.
- Reads of backup software credential stores. The first recorded September move was against the backup infrastructure on three servers.
- Attempts to remove or disable endpoint detection tools before encryption.
- Any system that is acting inside the domain without an agent. Every attacker action Bitdefender saw came from an unmanaged host.
Each of those is a low-volume event with a short list of legitimate causes, so an approval path for each is a realistic project for a small IT team.
What this means for the security leader
I would still read the paper for the pace data, because retry cadence may become a useful hunting signal once more incident responders publish theirs. I would not budget around it. The estate in this case had ten workstations still on Windows 10 and a domain controller on Windows Server 2012 R2, and the domains had been separate until the attacker joined them. Segmentation and patching kept their value, and so did watching the few events that cannot be avoided. The earlier question about whether AI-run ransomware beats your response clock deserves a measured answer: this case shows machine assistance, and it also shows an attacker who still spent from 10 to 19 September inside the estate.
Source: Bitdefender, 3AM Hits European Schools: A Hybrid AI Ransomware Attack
