3Am
Parsing : Enabled
Description
3AM, also known as ThreeAM, is a relatively new ransomware family that emerged in late 2023, initially deployed as a fallback option when LockBit infections failed. Written in Rust for 64-bit systems, it appends the “.threeamtime” extension to encrypted files and tags them with the marker “0x666,” while deleting Volume Shadow Copies to hinder recovery. 3AM operators use a double extortion strategy, combining file encryption with data theft and threats to leak stolen information. More recent campaigns have shown increased sophistication, incorporating email bombing followed by vishing calls to convince victims to grant remote access via Microsoft Quick Assist. Attackers then deploy virtual machines containing backdoors, allowing them to remain undetected while exfiltrating data before attempting to launch the ransomware payload.
| External Analysis |
| https://security.com/threat-intelligence/3am-ransomware-lockbit |
| https://tripwire.com/state-of-security/3am-ransomware-what-you-need-know |
| https://news.sophos.com/en-us/2025/05/20/a-familiar-playbook-with-a-twist-3am-ransomware-actors-dropped-virtual-machine-with-vishing-and-quick-assist/ |
| https://quorumcyber.com/malware-reports/3am-ransomware-report/ |
| https://sos-vo.org/index.php/news/cybersecurity-snapshots-3am-ransomware |
| https://darkreading.com/threat-intelligence/3am-ransomware-adopts-email-bombing-vishing |
| Mail |
| threeam@onionmail.org |
| Urls |
Screen |
| http://threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onion |
Screen |
| File servers |
Screen |
| http://ulkvlj5sirgrbnvb4hvbjo2ex2c2ceqe2j4my57fcdozpbq5h5pyu7id.onion |
Screen |
| Chat servers |
Screen |
| http://threeam7fj33rv5twe5ll7gcrp3kkyyt6ez5stssixnuwh4v3csxdwqd.onion/ |
Screen |
Posts
| Date |
Title |
Description |
Screen |
| 2025-09-04 |
townofnorwell.net |
The Town of Norwell MA offers a variety of municipal services including animal control, building permits, health clinics, and recreational programs. It serves the residents of Norwell by ensuring public safety, facilitating community events, and providing resources for aging individuals. The town focuses on promoting a multigenerational community through initiatives like the Community Center Project. Furthermore, Norwell is engaged in environmental conservation and provides housing and transportation services to its citizens. |
Screen |
| 2025-09-04 |
curedentalbeltontx.com |
Cure Dental is a company that operates in the Dental Offices industry. It employs 10to19 people and has 1Mto5M of revenue. The company is headquartered in Belton, Texas. |
Screen |
| 2025-09-04 |
austinplasticandreconstructivesurgery.com |
Austin Plastic Reconstructive Surgery, led by Board-Certified Plastic Surgeon Dr. Christine Fisher, specializes in breast reconstruction and a variety of cosmetic surgery procedures. The clinic caters to individuals seeking to enhance their beauty and restore confidence, particularly women recovering from breast cancer. Their offerings include breast, body, and facial procedures, as well as advanced medspa treatments for skin rejuvenation. The team is committed to providing personalized care and transformative results in a welcoming environment. |
Screen |
| 2025-07-19 |
sequoiadental.com |
Sequoia Dental Office provides a wide range of dental services including general, cosmetic, orthodontic, and restorative dentistry. Located in Visalia, CA, they are dedicated to patient comfort and use advanced technology to enhance care, offering |
|
| 2025-06-28 |
wyomingcountyny.gov |
|
Screen |
| 2025-05-25 |
vazirilaw.com |
|
|
| 2025-04-10 |
gosvt.com |
|
Screen |
| 2025-04-10 |
neffendorfblockercpa.com |
|
Screen |
| 2025-04-10 |
jastreet.com |
|
Screen |
| 2025-04-10 |
icmtx.com |
|
Screen |
| 2025-04-10 |
dbhcares.com |
|
Screen |
| 2025-04-10 |
icgad.com |
|
Screen |
| 2025-04-10 |
iss-na.com |
|
Screen |
| 2025-04-10 |
kkp.law |
|
Screen |
| 2025-02-13 |
leonardo.com |
|
Screen |
| 2025-02-12 |
sehma.com |
|
Screen |
| 2025-02-05 |
corehandf.com |
|
Screen |
| 2025-01-30 |
soitinlaine.fi |
|
Screen |
| 2025-01-15 |
anwsd.org |
|
Screen |
| 2025-01-09 |
hapsch.de |
|
Screen |
| 2024-12-17 |
kuritaamerica.com |
|
Screen |
| 2024-12-04 |
hobokennj.gov |
|
Screen |
| 2024-11-13 |
midstatesindustrial.com |
|
Screen |
| 2024-10-31 |
anuenterprise.com.au |
|
Screen |
| 2024-10-31 |
inhometexas.com |
|
Screen |
| 2024-10-31 |
caillau.com.br |
|
Screen |
| 2024-10-31 |
sandray.com |
|
Screen |
| 2024-10-31 |
mpspromotions.com |
|
Screen |
| 2024-10-31 |
freedomhomecare.net |
|
Screen |
| 2024-10-24 |
carolinaarthritis.com |
|
Screen |
| 2024-10-24 |
sacredheart.southwark.sch.uk |
|
Screen |
| 2024-10-24 |
oklahomasleepinstitute.com |
|
Screen |
| 2024-10-10 |
oklahomasleepinstitute.co... |
|
Screen |
| 2024-09-30 |
carlile-group.com |
|
Screen |
| 2024-09-30 |
sacredheart.southwark.sch... |
|
Screen |
| 2024-09-30 |
mctas.org.au |
|
Screen |
| 2024-09-30 |
mnpl.com.sg |
|
Screen |
| 2024-09-30 |
verco.co.uk |
|
Screen |
| 2024-09-17 |
gestiriego.com |
|
Screen |
| 2024-09-13 |
brunswickhospitalcenter.org |
|
Screen |
| 2024-09-12 |
brunswickhospitalcenter.o... |
|
Screen |
| 2024-08-07 |
visitingphysiciansnetwork... |
|
Screen |
| 2024-08-07 |
compagniedephalsbourg.com... |
|
Screen |
| 2024-05-15 |
thermalsolutionsllc.com |
|
Screen |
| 2024-05-15 |
escriba.com.br |
|
Screen |
| 2024-04-15 |
compagniedephalsbourg.com |
|
Screen |
| 2024-03-25 |
kh.org |
|
Screen |
| 2024-02-27 |
moore-tibbits.co.uk |
|
Screen |
| 2024-02-22 |
mtmrobotics.com |
|
Screen |
| 2024-02-22 |
abcor.com.au |
|
Screen |
| 2024-02-21 |
doneff.com |
|
Screen |
| 2024-02-13 |
garonproducts.com |
|
Screen |
| 2024-02-01 |
etsolutions.com.mx |
|
Screen |
| 2024-01-12 |
thecsi.com |
|
Screen |
| 2024-01-12 |
pharrusa.com |
|
Screen |
| 2023-12-12 |
shareharris.com |
|
Screen |
| 2023-12-12 |
woodruffenterprises.com |
|
Screen |
| 2023-12-06 |
syrtech.com |
|
Screen |
| 2023-12-05 |
ussignandmill.com |
|
Screen |
| 2023-11-27 |
carrellblanton.com |
|
Screen |
| 2023-11-22 |
ds-granit.fr |
|
Screen |
| 2023-11-18 |
nealbrothers.co.uk |
|
Screen |
| 2023-10-26 |
maniland.co.uk |
|
Screen |
| 2023-10-26 |
claimtek.com |
|
Screen |
| 2023-09-28 |
simmonsequip.com |
|
Screen |
| 2023-09-22 |
haciendazorita.com |
|
Screen |
| 2023-09-22 |
fi-tech.com |
|
Screen |
| 2023-09-22 |
neuraxpharm.com |
|
Screen |
| 2023-09-17 |
pvbfabs.com |
|
Screen |
| 2023-09-17 |
wdgroup.com.my |
|
Screen |
| 2023-09-17 |
intechims.com |
|
Screen |
| 2023-09-17 |
zero-pointorganics.com |
|
Screen |
| 2023-09-17 |
visitingphysiciansnetwork.com |
|
Screen |
| 2023-09-17 |
clearwaterlandscape.com |
|
Screen |