A new ransomware family called 3AM appears in the threat landscape

3AM is a new strain of ransomware that was spotted in a single incident in which the threat actors failed to deploy the LockBit ransomware in the target infrastructure.

Symantec’s Threat Hunter Team discovered a new ransomware family, which calls itself 3AM, that to date has only been deployed in a single incident in which the threat actors failed to deploy the LockBit ransomware.

The threat actors managed to deploy the ransomware to three computers on the target organization’s network, but it was blocked on two of those three machines.

3AM is a brand new ransomware written in Rust. Before starting the encryption process, the ransomware attempts to stop multiple services. Once the encryption of the files is completed, it attempts to delete Volume Shadow (VSS) copies. The malware appends the extension .threeamtime to the filenames of encrypted files. The researchers have yet to determine if the threat actors behind 3AM are linked to known cybercrime groups. 

The attackers were spotted using the post-exploitation tool Cobalt Strike, then attempted to run reconnaissance commands (i.e. whoami, netstat, quser, and net share) for lateral movement. The exact ingress route employed in the attack is unclear.

The attackers attempted to maintain persistence by adding a new user and used the Wput tool to exfiltrate the files to their own FTP server.

The ransomware is a 64-bit executable that supports multiple commands to stop applications to perform backups and security software.

The malware only encrypts files matching predefined criteria.

Below is the Tor “Support” portal for 3AM that is used by the operators to negotiate ransom demands with victims.

“Ransomware affiliates have become increasingly independent from ransomware operators and this is not the first time Symantec has seen an attacker attempt to deploy two different kinds of ransomware in a single attack.” concludes the report. “New ransomware families appear frequently and most disappear just as quickly or never manage to gain significant traction. However, the fact that 3AM was used as a fallback by a LockBit affiliate suggests that it may be of interest to attackers and could be seen again in the future.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)