3AM

3AM, also written ThreeAM, is a ransomware operation first publicly reported in 2023 after attackers were observed switching to it when a LockBit deployment failed. Multiple investigations have linked 3AM to the Royal and BlackSuit lineage and, more broadly, to former Conti operators. Reporting has also described Royal as a newer iteration of 3AM or a closely related rebrand, reflecting overlap in personnel, infrastructure, and tradecraft rather than a clean separation between brands.

3AM is used in financially motivated intrusions that emphasize rapid hands-on-keyboard post-compromise activity, data theft, and enterprise-wide encryption. Observed operator behavior includes extensive reconnaissance, abuse of valid accounts, lateral movement over administrative protocols and remote desktop access, deployment of additional remote management tooling, and attempts to weaken defensive controls such as endpoint protection and multifactor authentication. In at least one documented intrusion, operators exfiltrated large volumes of data before attempting ransomware deployment, consistent with modern double-extortion practices.

A notable tradecraft pattern associated with 3AM involves voice-based social engineering. Intrusions have begun with email bombing followed by spoofed calls impersonating internal IT staff, persuading users to grant remote access through remote assistance tools. In one investigated case, the attackers then launched a QEMU-based virtual machine on the victim host containing the QDoor backdoor, creating a stealthy foothold that initially evaded endpoint detection and enabled persistence, command and control, and lateral movement. Operators also used native administration utilities, PowerShell, WMIC, RDP, and commercial remote management software during follow-on activity.

3AM has also been associated with Microsoft Teams-based vishing activity and clusters linked to BlackBasta-style social engineering operations, indicating convergence between ransomware affiliates and access brokers using help-desk impersonation. Researchers have additionally observed experimentation with public-pressure extortion tactics, including social-media amplification intended to increase reputational pressure on victims.

Victimology is consistent with broad opportunistic enterprise targeting rather than a narrow vertical focus, with incidents and reporting spanning industrial and corporate environments. The operation is best understood as part of the post-Conti ransomware ecosystem, where rebranding, affiliate migration, and shared tooling blur boundaries between nominally distinct groups.