Ransomware is a universal threat to enterprises, targeting anyone handling sensitive data when profit potential is high.
A new ransomware named 3AM has surfaced and is used in a limited manner. Symantec’s Threat Hunter Team witnessed it in a single attack, replacing LockBit when blocked.
3AM is a Rust-written ransomware that is completely unexplored that ceases services, encrypts files and tries to delete VSS copies. However, besides this, its connections to cybercrime groups remain uncertain.
The threat actor’s initial actions included running ‘gpresult’ to extract policy settings, deploying Cobalt Strike components, and attempting privilege escalation with PsExec.
The attackers conducted reconnaissance with the following commands for lateral movement opportunities:-
They established persistence by adding a new user and exfiltrated files using Wput to their FTP server. The attackers initially tried LockBit, but after it was blocked, they turned to 3AM.
Their use of 3AM was partially successful, as it only infected three out of the organization’s machines, with two of them successfully blocking it.
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
3AM gets its name from the ‘.threeamtime’ file extension it adds to encrypted files, as referenced in the ransom note.
Threat researcher Ygor Maximo has recently identified a leaked website belonging to the 3AM ransomware group. The website currently lists six victims who have fallen prey to the group’s notorious activities. This discovery highlights the ever-increasing threat posed by ransomware attacks and serves as a reminder of the importance of robust cybersecurity measures to protect businesses and individuals alike.
This Rust-based ransomware recognizes the following command-line parameters since it’s a 64-bit executable:-
The malware tries to run the following commands after its execution, and it mainly targets the security and backup software:-
The ransomware scans encrypts matching files, deletes originals, and drops a ‘RECOVER-FILES.txt’ ransom note in each folder. Besides this, the encrypted files have a ‘0x666’ marker followed by ransomware data.
Ransomware affiliates act more independently, with some deploying multiple ransomware strains in one attack. While many new ransomware families fade quickly, 3 AM’s use as a LockBit affiliate fallback hints at potential future relevance for attackers.
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT group and their ongoing RustBucket campaign. As…
Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision of the .NET framework, the Serpent…
It has been observed that threat actors are using AI technology to conduct illicit operations on social media platforms. These…
Kali Linux 2023.4, the latest version of Offensive Security's renowned operating system, has been released, and it includes the advanced…
A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware. Trickbot, a suite of malware tools,…
ICANN is a non-profit organization that is responsible for coordinating the global internet's- DNS IP address allocation This organization manages…