Início / Ransomware Intelligence / Todos os grupos / threeam

threeam Ransomware

Também conhecido como: 3Am · Monitorado desde 14/09/2023

vítimas registradas

nos últimos 30 dias

CVEs

—

Última atividade

A new Ransomware family identified by the name '3AM' or 'ThreeAM' in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy another ransomware, LockBit, on the target network and then switched to 3AM when LockBit was reportedly blocked.

>

> The ransomware operation, according to the publication on its Tor-based website, has been operating since mid-August 2023, according to the publication from its first victim.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

Nenhuma CVE associada a este grupo nas fontes.

Táticas e técnicas (MITRE ATT&CK)

Persistence

T1136 Create Account

Privilege Escalation

T1543.003 Service Execution T1548.002 Bypass User Account Control

Defense Evasion

T1070.001 Clear Windows Event Logs T1562.004 Disable or Modify System Firewall Settings

Discovery

T1018 Remote System Discovery T1135 Network Share Discovery T1615 Group Policy Discovery

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Impact

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live