3am Ransomware Group
Ransomware group profile
Description
Threeam is a ransomware group that emerged in February 2023, known for its quick deployment and sophisticated encryption methods. Primarily motivated by financial gain, they employ double extortion tactics to pressure high-value organizations into paying ransoms after encrypting their data and exfiltrating sensitive information.
Key insights
- •Utilizes custom-built ransomware variants written in Rust.
- •Employs social engineering tactics to gain initial access, including phishing and voice phishing.
- •Focuses on double extortion by encrypting files and threatening to release sensitive data publicly.
- •Targets high-value sectors such as healthcare and financial services.
- •Uses advanced evasion techniques like disabling security software and deleting Volume Shadow Copies.
- •Linked to other ransomware operations like LockBit and Conti, indicating a collaborative nature among threat groups.
Threat Level & Status Breakdown
For 3am · Based on incidents in selected period
Recent activity
Monthly attack count for 3am in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for 3am
T1070.001
Clear Windows Event Logs
T1562.004
Disable or Modify System Firewall
T1018
Remote System Discovery
T1135
Network Share Discovery
T1615
Group Policy Discovery
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1136
Create Account
T1543.003
Windows Service
Victims(23)
| Company | Domain | Country | Industry | Status | Discovered | |
|---|---|---|---|---|---|---|
| tws-tac.net | — | — | — | Unknown | 7 days ago | |
| guardianbarrierservices.com | — | — | Professional Services | Unknown | 17 days ago | |
| acemacon.org | — | — | Government & Defense | Unknown | 19 days ago | |
| jetmachprod.com | — | US United States | Manufacturing | Unknown | about 1 month ago | |
| jastrebarsko.hr | — | HR Croatia | Government & Defense | Unknown | about 1 month ago | |
| palmero.com | — | AR Argentina | Other | Unknown | about 1 month ago | |
| insamani.com.ar | — | AR Argentina | Other | Unknown | about 1 month ago | |
| bsynchro.com | — | — | Financial Services | Unknown | about 1 month ago | |
| molinoscabodi.com.ar | — | AR Argentina | Manufacturing | Unknown | about 1 month ago | |
| ws.com.br | — | BR Brazil | Professional Services | Unknown | about 1 month ago | |
| consultic.be | — | BE Belgium | Technology | Unknown | about 1 month ago | |
| amc.org.au | — | AU Australia | Education | Unknown | about 1 month ago | |
| agroexportavocados.com | — | MX Mexico | Other | Unknown | about 1 month ago | |
| hoplongtech.com | — | VN Vietnam | Technology | Unknown | about 1 month ago | |
| mgrlaw.com | — | US United States | Professional Services | Unknown | about 1 month ago | |
| aceforwarding.com | — | US United States | Transportation | Unknown | 8 months ago | |
| Ic Controls | ic-controls.com | DE Germany | Manufacturing | Unknown | 8 months ago | |
| bun.nl | — | NL Netherlands | Other | Unknown | 9 months ago | |
| hsjlawyers.com | — | CA Canada | Professional Services | Unknown | 10 months ago | |
| townofnorwell.net | — | US United States | Government & Defense | Unknown | 11 months ago |
Page 1 of 2
Affected countries(21)
Countries where this group has been reported to target or leak victims.