In the first quarter of 2025, Sophos Incident Response aided an organization targeted by attackers affiliated with the 3AM ransomware group.
3AM
3AM, also referred to as ThreeAM, is a ransomware operation first publicly reported in 2023 after operators were observed switching to it when a LockBit deployment failed.
Profile source: Mallory opens in a new tab3AM
Family profile
3AM, also referred to as ThreeAM, is a ransomware operation first publicly reported in 2023 after operators were observed switching to it when a LockBit deployment failed. Multiple researchers have assessed 3AM as closely connected to the Royal/BlackSuit lineage and to former Conti operators, based on overlaps in tradecraft, infrastructure, and operator behavior. It has also been linked in some reporting to actors associated with BlackBasta-style social-engineering intrusions.
3AM is used in financially motivated intrusions that combine social engineering, hands-on-keyboard post-compromise activity, data theft, and attempted encryption. Observed access patterns include email bombing followed by voice phishing or Microsoft Teams impersonation of internal IT or help-desk staff to persuade users to grant remote access through legitimate remote-support tools. In documented cases, operators used Quick Assist and other remote administration utilities to establish an initial foothold.
Post-compromise activity associated with 3AM includes reconnaissance, credential and account abuse, lateral movement over administrative protocols, persistence establishment, and exfiltration prior to ransomware deployment. In one investigated intrusion, the attackers deployed a QEMU-based virtual machine containing the QDoor backdoor to create a stealthy foothold, then used compromised accounts, WMIC, PowerShell, RDP, and commercial remote-management software to expand access across the environment. The same intrusion involved large-scale data theft to cloud storage before an attempted 3AM encryption event. Operators also attempted to weaken defenses by uninstalling MFA components and endpoint protections, though those efforts were not always successful.
3AM campaigns have targeted enterprise Windows environments, including organizations in North America, and broader reporting places the group within the active ransomware ecosystem affecting multiple sectors. The operation has also experimented with extortion pressure beyond encryption, including public leak-site activity and at least one observed attempt to amplify victim pressure through social-media replies linking to leaked data. Its leak-site presentation has been noted as resembling LockBit.
Overall, 3AM is best understood as a ransomware brand operating within the post-Conti criminal ecosystem, using modern social-engineering-led intrusion methods, established backdoors and remote-access tooling, data exfiltration, and double-extortion tactics against enterprise victims.
Capabilities
- Defense Evasion
- Exfiltration
- Extortion
- Initial Access
- Lateral Movement
- Persistence
- Post Exploitation
- Reconnaissance
- Spoofing
Operational record
1
YARA rules
2
Leak sites
2 available
Recent claims
Reported operators
Threat actors
2 named in public reportingSecurity researchers analyzing the activity of the recently emerged 3AM ransomware operation uncovered close connections with infamous groups, such as the Conti syndicate and the Royal ransomware gang.
MITRE ATT&CK
3AM in ATT&CK
18 distinct techniquesTechniques
18 techniques T1033 System Owner/User Discovery T1489 Service Stop T1082 System Information Discovery T1135 Network Share Discovery T1059 Command and Scripting Interpreter T1486 Data Encrypted for Impact T1657 Financial Theft T1490 Inhibit System Recovery T1046 Network Service Discovery T1195 Supply Chain Compromise T1136 Create Account T1543.003 Service Execution T1548.002 Bypass User Account Control T1070.001 Clear Windows Event Logs T1562.004 Disable or Modify System Firewall Settings T1018 Remote System Discovery T1615 Group Policy Discovery T1048 Exfiltration Over Alternative Protocol
Reporting
Research mentioning 3AM
Jul 16
Register Security
Telegram shortlinks knocked offline over sanctioned VPN connection
The U.S. Treasury sanctioned First VPN Service (1VPNS), its alleged Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for allegedly supporting ransomware and other cybercriminal activity. Officials said 1VPNS provided anonymizing infrastructure that helped threat actors hide their identities, disguise malware, and evade detection during attacks on U.S. municipalities, hospitals, schools, businesses, and critical infrastructure providers. Treasury alleged Rashevskyi used false identities to obtain infrastructure for the service, while Silayev sold malware-obfuscation tools that made malicious code harder for defenders to detect. The sanctions, issued under Executive Order 14390 and E.O. 13694 as amended, block U.S. persons from transacting with the designated parties and mark a broader move against ransomware enablers rather than only the gangs themselves. The action was coordinated with the United Kingdom and followed a May law enforcement takedown of 1VPNS infrastructure by European agencies with FBI support. Separate reporting said blockchain tracing tied payments from ransomware groups including Anubis, Qilin, and Sinobi Group to FirstVPN, adding financial evidence that the service was used as operational infrastructure by ransomware actors.
Jul 15
Scworld
U.S. sanctions VPN provider and cryptor seller for aiding ransomware gangs | brief | SC Media
Jul 15
Xakep
ΠΠ»Π°ΡΡΠΈ Π‘Π¨Π Π½Π°Π»ΠΎΠΆΠΈΠ»ΠΈ ΡΠ°Π½ΠΊΡΠΈΠΈ Π½Π° First VPN ΠΈΠ·-Π·Π° ΡΠ²ΡΠ·Π΅ΠΉ Ρ Π²ΡΠΌΠΎΠ³Π°ΡΠ΅Π»ΡΠΌΠΈ - Π₯Π°ΠΊΠ΅Ρ
Jul 14
Security Affairs
U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses
Jul 14
Cyberscoop
US sanctions First VPN and administrator for supporting ransomware | CyberScoop
Jul 14
Chainalysis
βSternβ Ransomware Operator Sanctioned by EU
Jul 14
Cyber Security News
US Treasury Sanctions VPN Service that Helped Ransomware Actors to Attack Organizations
Jul 14
The Hacker News
