Skip to content
DysruptionHub
Sign in Subscribe

ThreeAM

Ransomware Group2 claimsLast activity:
Also known as:
  • 3am

Overview

ThreeAM, also styled 3AM, is a ransomware and data-extortion operation associated with a Rust-based file encryptor. Symantec first documented the ransomware in September 2023 after observing an affiliate use it when a LockBit deployment was blocked. The malware adds the .threeamtime extension and attempts to stop services and remove shadow copies. Its ransom message threatens to sell stolen information if an agreement is not reached. Sophos later documented affiliated attackers using impersonation of IT support, email bombing and remote-access tools in a separate intrusion. These observations describe reported capabilities and do not establish the method used in every attributed incident.

Incident claims

Ransomware disrupts Addison Northwest school systems

Incident date: Source: ransomware.liveDiscovered:

Claim details

Ransomware.live observed a ThreeAM listing for anwsd.org on Jan.15,2025; that is the tracker observation, not the original actor publication or attackdate. Separately, the district’s Jan.13boardminutes identify a ThreeAM/3AM ransomware exploit on multipledevices and a ransomnote; they relay an FBI account of attacker claims of encryption, theft and sale. Officialfamilyidentification supports involvement independently of listing, while actualstolencategories/count and individualoperators remain unverified. Reuse this existingclaim and canonicalactor; stale fourschoolmarketingtext is not incident scope.

City of Hoboken ransomware incident

Incident date: Source: ransomware.liveDiscovered:

Claim details

Ransomware.live lists the City of Hoboken’s official domain under ThreeAM, discovered Dec. 4, 2024. The Record’s original Dec. 5 report says the group claimed responsibility Wednesday, Dec. 4, without specifying what data was stolen or how much. The tracker discovery time is not a verified original post time or intrusion date. This is an attacker claim; Hoboken independently confirmed ransomware and unauthorized file access but did not confirm this actor, data exfiltration or a ransom payment. Preserve the existing ThreeAM entity and its separately sourced research.

Impacted organizations

Impacted locations

Sources

Created Last updated