Threeam, also known as 3AM, is a ransomware group that first appeared in February 2023, though its operations gained broader attention later that year. The group's primary motivation is financial gain through aggressive ransom demands and double extortion tactics. It notably emerged as a secondary payload, often deployed by affiliates when primary ransomware, such as LockBit, failed during initial attacks. This characteristic, along with its unique implementation in the Rust programming language for enhanced speed and stealth, sets threeam apart from many other ransomware operations. It is assessed with moderate confidence to be of Russian origin, given observed language use and connections to other Russia-linked ransomware operations like LockBit. The group is also associated with BlackSuit ransomware and has links to core elements of the disbanded Conti group.

Aliases del actor

Time 3AM

Actores similares

3amransomware · 15XENOTIMEapt · 0

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker