Blog
The headline said AI. The retry took 41 seconds.
On 13 September a command in a reported UK school-estate intrusion was re-run unchanged after 41 seconds. What a tabletop packet may write about that, starting from the backup servers on 10 September.
On 3 November 2026 Bitdefender published a research write-up of a 3AM ransomware affiliate intrusion at a UK school estate. The same day BleepingComputer and Dark Reading reported it. The school is not named. Bitdefender says the 3AM attribution is confirmed, initial access is unknown, and the machine list held 47 systems. BleepingComputer, reporting the same research, says about 37 of nearly 50 machines reached from an unmanaged host were encrypted. The hands-on window in the write-up runs from 10 to 19 September 2026. The first recorded September action is credential theft from three Veeam backup servers on 10 and 11 September. Encryption is a 19 September phase.
On 13 September the write-up times one sequence to the second. A command was run, re-run unchanged 41 seconds later, changed in a single call 49 seconds after that, and replaced 47 seconds later. Across the retries the gap sat between 40 and 101 seconds, whatever the size of the edit. In one stretch that day the gaps between tasks were 5, 2, 14, 16, and 3 minutes. One call to the backup product's web interface used a port and a login method that do not match the vendor's documentation, which Bitdefender treats as a mistake typical of writing from memory. They split what that can support into three claims. The content of the commands strongly supports a model having generated them. The retry rhythm behaves like an agentic loop, and a person pasting between a shell and a chat window cannot be excluded. Nothing in the telemetry supports a hands-on phase with no human in it. They did not have the machine the operator worked from, so they cannot say which model it was, where it ran, or whether anyone was pasting. They call the hybrid reading a working model to plan around, not an established fact, and they call the case one anecdote, not a trend. The quickest retries still took 40 seconds or more. Martin Zugec of Bitdefender told Dark Reading that the loop makes the activity repetitive rather than quiet, and that speed is not the giveaway.
A weak record, written the afternoon those headlines land, reads:
AI ransomware confirmed. A machine-speed agent encrypted the estate. We would have isolated faster.
A strong one reads:
4 November 2026, 14:00 to 15:10. Incident-response tabletop. Injects are the published timeline, not our telemetry. Seats: Helen Cho (incident commander), Chris Adeyemi (on-call), Renee Okonkwo (communications). Noor Alavi (directory, owns domain trusts) was not in the room. Sources named in the packet: Bitdefender research published 3 November 2026, reported the same day by BleepingComputer and Dark Reading. UK school estate, unnamed. 3AM attribution is Bitdefender's, and they say it is confirmed. Hands-on window 10 to 19 September 2026. Initial access unknown. 47 systems on the list. About 37 of nearly 50 machines reached from an unmanaged host were encrypted, per BleepingComputer's account of the research. First recorded September action: credential theft from three Veeam backup servers, 10 to 11 September. The account named library added to Domain Admins at 19:06 UTC on 14 September. The account named svc_bkpmon added to Domain Admins at 00:03 UTC on 15 September. Two-way trusts joined three previously separate domains inside about three hours on 18 September. Encryption phase 19 September. On 13 September a command was re-run unchanged after 41 seconds, edited after 49, and replaced after 47. Retry gaps 40 to 101 seconds. Task gaps in one stretch: 5, 2, 14, 16, and 3 minutes. Bitdefender: command content strongly supports a model having generated the commands; the rhythm behaves like a loop and a person pasting cannot be excluded; a hands-on phase with no human is unsupported; the operator's machine was not available. Hybrid reading is their working model, not an established fact. One case, which they call an anecdote. At 14:22, on the 14 September inject, Renee drafted a board sentence that said an AI agent was encrypting systems. Encryption is the 19 September inject and had not been read out. Helen stopped the draft. Nothing was sent. The packet does not say a model ran the loop. Follow-up: Noor, by 18 November 2026, writes whether a new Domain Admin or a new trust pages anyone, and adds that line to the plan or writes why it is absent.
Both notes can sit under the same headline. Only the second can be checked by someone who was not in the room and who does not have the three articles open. The first costs you the nine days. A reader in March practises a machine-speed encryption, and nobody owns the question of who declares when the only fact on the table is a backup server on 10 September.
Declare when the backup servers move
At 14:06 Helen reads the first inject aloud. It is 10 September in the timeline. Three Veeam backup servers, credentials copied, no ransom note, no renamed file. The plan's ransomware section starts at the note: who isolates, who drafts the customer line. It names Helen as the person who declares. It has no sentence for this morning. Chris wants to wait, because waiting matches the first line he can find, and the plan does not tell him that credential theft from the backup console is a declaration. The free plan self-check asks whether the plan names who declares, who runs the response, and who tells customers. Helen is named. The missing line is the fact she is supposed to declare on. Write that fact into the plan, or the next room waits for a note while the published timeline has already spent 10 and 11 September on the backup servers, with encryption not until 19 September.
A new trust is a directory decision
The timeline then names two accounts and a trust change, with clocks. At 19:06 UTC on 14 September, the account named library is added to Domain Admins. At 00:03 UTC on 15 September, the account named svc_bkpmon is added to Domain Admins. On 18 September, two-way trusts join three domains that had been separate, inside about three hours. Bitdefender calls a new trust between domains a rare change. The write-up does not say this estate alerted on it, and it does not say a control blocked it. In the room, the person who would know whether our plan pages anyone for a new Domain Admin or a new trust is Noor, and Noor is not on the bridge. Chris can read the inject. He cannot answer it. The finding is the empty seat and the plan line that never mentions a trust. It is not a score on detection.
Three claims, and the sentence that used none of them
Renee's draft at 14:22 said an AI agent was encrypting systems. The inject in front of the room was the 14 September account. The encryption phase is the 19 September inject, and Helen had not read it out. Even after that inject, the source text supports three different sentences, and Bitdefender labels them differently. The commands look like a model wrote them: they say the content strongly supports that. A loop may have chosen the next command: they say it behaves like one, and a person pasting cannot be excluded. Nobody human was at the keyboard: they say the telemetry does not support that. The draft uses a fourth sentence, which the articles do not say. Helen stops it. If a board line is written at all, it names which of the three claims it is making, names the source, and names the date. Wording that would leave the building follows the same rule as the customer-notice post: practise the sentence, and do not send it from the exercise.
The honest limit belongs here. The sitting shows that Helen, Chris, and Renee practised declaration, the trust question, and which sentence they were willing to write, against a timeline somebody else published. It does not show that a model ran the loop. Bitdefender already said that reading is not an established fact, and a tabletop does not upgrade it. It does not show that a backup server would have alerted, that a new trust would have been blocked, or that backups restore, and it is not a pen test of your own estate. Those are technical tests. A conversation about this timeline is evidence of an exercise. The split between that conversation and a restore test is the one in the ransom-note post.
An agent you operate, taking an action nobody authorised, is a different inject, covered in the off-script agent post. This timeline is a ransomware affiliate's hands-on phase. The packet's job is to keep the clocks and the three claims apart.
Where the lines go
Write the clocks, the three claims, the stopped draft, and Noor's empty seat in the free evidence template. Put the inject on the ransomware family in the scenario library, and start the clock at the Veeam servers on 10 September rather than at a note. That family is a decision exercise. The news using the word AI does not turn it into a detection test. Both records sit in the template library.
The file from 4 November shows who was in the room, which published clocks they practised, and that the board sentence was stopped at 14:22. It does not show that Noor's follow-up was done. That line is due 18 November, and it is still a sentence until someone checks the plan.
Bottom line: write the 41 seconds, the 10 September backup servers, and which of the three claims you are actually making. A headline that says machine speed is a different incident from the one in the articles, and the packet has to survive a reader who has the articles open.