Ransomware needs a way in. Stolen credentials are the cheapest one.
3am Ransomware Group
Ransomware group profile
Description
Threeam is a ransomware group that emerged in February 2023, known for its quick deployment and sophisticated encryption methods. Primarily motivated by financial gain, they employ double extortion tactics to pressure high-value organizations into paying ransoms after encrypting their data and exfiltrating sensitive information.
Key insights
- •Utilizes custom-built ransomware variants written in Rust.
- •Employs social engineering tactics to gain initial access, including phishing and voice phishing.
- •Focuses on double extortion by encrypting files and threatening to release sensitive data publicly.
- •Targets high-value sectors such as healthcare and financial services.
- •Uses advanced evasion techniques like disabling security software and deleting Volume Shadow Copies.
- •Linked to other ransomware operations like LockBit and Conti, indicating a collaborative nature among threat groups.
Threat Level & Status Breakdown
For 3am · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for 3am in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for 3am
- 185.202.0.111
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for 3am
T1070.001
Clear Windows Event Logs
T1562.004
Disable or Modify System Firewall
T1018
Remote System Discovery
T1135
Network Share Discovery
T1615
Group Policy Discovery
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1136
Create Account
T1543.003
Windows Service
Victims(13)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Palmero | Argentina | Claimed | 2 months ago | |
| INSA INDELMA S.A. | Argentina | Claimed | 2 months ago | |
| BSynchro Holding | Germany | Claimed | 2 months ago | |
| molinoscabodi.com.ar | Argentina | Claimed | 2 months ago | |
| WS Soluções Corporativas Ltda. | Brazil | Claimed | 2 months ago | |
| AGROEXPORT INTERNACIONAL | Mexico | Claimed | 2 months ago | |
| hoplongtech.com | Vietnam | Claimed | 2 months ago | |
| Ic Controls | Germany | Claimed | 9 months ago | |
| bun.nl | Netherlands | Claimed | 10 months ago | |
| hsjlawyers.com | Canada | Claimed | 10 months ago | |
| townofnorwell.net | United States | Claimed | 11 months ago | |
| curedentalbeltontx.com | United States | Claimed | 11 months ago | |
| austinplasticandreconstructivesurgery.com | United States | Claimed | 11 months ago |
Affected countries(24)
Countries where this group has been reported to target or leak victims.