A new ransomware family called 3AM appears in the threat landscape

3AM is a new strain of ransomware that was spotted in a single incident in which the threat actors failed to deploy the LockBit ransomware in the target infrastructure.

Symantec’s Threat Hunter Team discovered a new ransomware family, which calls itself 3AM, that to date has only been deployed in a single incident in which the threat actors failed to deploy the LockBit ransomware.

The threat actors managed to deploy the ransomware to three computers on the target organization’s network, but it was blocked on two of those three machines.

3AM is a brand new ransomware written in Rust. Before starting the encryption process, the ransomware attempts to stop multiple services. Once the encryption of the files is completed, it attempts to delete Volume Shadow (VSS) copies. The malware appends the extension .threeamtime to the filenames of encrypted files. The researchers have yet to determine if the threat actors behind 3AM are linked to known cybercrime groups. 

The attackers were spotted using the post-exploitation tool Cobalt Strike, then attempted to run reconnaissance commands (i.e. whoami, netstat, quser, and net share) for lateral movement. The exact ingress route employed in the attack is unclear.

The attackers attempted to maintain persistence by adding a new user and used the Wput tool to exfiltrate the files to their own FTP server.

The ransomware is a 64-bit executable that supports multiple commands to stop applications to perform backups and security software.

The malware only encrypts files matching predefined criteria.

Below is the Tor “Support” portal for 3AM that is used by the operators to negotiate ransom demands with victims.

“Ransomware affiliates have become increasingly independent from ransomware operators and this is not the first time Symantec has seen an attacker attempt to deploy two different kinds of ransomware in a single attack.” concludes the report. “New ransomware families appear frequently and most disappear just as quickly or never manage to gain significant traction. However, the fact that 3AM was used as a fallback by a LockBit affiliate suggests that it may be of interest to attackers and could be seen again in the future.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe Commerce and Magento, SolarWinds Serv-U, and…

1 hour ago

Threat actors attempted to capitalize CrowdStrike incident

CrowdStrike warns that threat actors are exploiting the recent IT outage caused by their faulty…

17 hours ago

Russian nationals plead guilty to participating in the LockBit ransomware group

Two Russian nationals pleaded guilty to participating in the LockBit ransomware group and carrying out…

1 day ago

MediSecure data breach impacted 12.9 million individuals

Personal and health information of 12.9 million individuals was exposed in a ransomware attack on…

2 days ago

CrowdStrike update epic fail crashed Windows systems worldwide

Windows machines worldwide displayed BSoD screen following a faulty update pushed out by cybersecurity firm…

2 days ago

Cisco fixed a critical flaw in Security Email Gateway that could allow attackers to add root users

Cisco has addressed a critical vulnerability that could allow attackers to add new root users…

2 days ago

This website uses cookies.