Home / Ransomware Intelligence / All groups / threeam

threeam Ransomware

Also known as: 3Am · Tracked since Sep 14, 2023

victims recorded

in the last 30 days

CVEs

—

Last activity

A new Ransomware family identified by the name '3AM' or 'ThreeAM' in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy another ransomware, LockBit, on the target network and then switched to 3AM when LockBit was reportedly blocked.

>

> The ransomware operation, according to the publication on its Tor-based website, has been operating since mid-August 2023, according to the publication from its first victim.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

No CVE associated with this group in the sources.

Tactics and techniques (MITRE ATT&CK)

Persistence

T1136 Create Account

Privilege Escalation

T1543.003 Service Execution T1548.002 Bypass User Account Control

Defense Evasion

T1070.001 Clear Windows Event Logs T1562.004 Disable or Modify System Firewall Settings

Discovery

T1018 Remote System Discovery T1135 Network Share Discovery T1615 Group Policy Discovery

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Impact

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live