3AM — Ransomware Profile
3AM is a Rust-based ransomware used as an alternative when LockBit deployment fails, targeting organizations across multiple sectors.Also tracked as
ThreeAM
Tools & malware
- Cobalt Strike Post-Exploitation Framework
- GoodSync Exfiltration Tool
- PsExec System Utility
- QDoor Backdoor
- QEMU Virtualization Tool
- Quick Assist Remote Access Tool
- Syncro Remote Management Tool
- Wput Exfiltration Tool
- XEOX Remote Management Tool
Recent claimed victims
- Fleetworks Inc. 2026-10-09
- St James’ Anglican School 2026-09-28
- BHN Expertise 2026-09-28
- Apexus 2026-09-28
- Midwest Business Technology 2026-09-28
- Pistones Persan 2026-09-28
- Coosalud EPS (Coosalud Entidad Promotora de Salud S.A.) 2026-09-28
- Safe Scaffolding 2026-09-28
- Since 1976, Newman Tractor 2026-09-21
- Twin States News 2026-08-30
- mecasem.org 2026-08-19
- Club One Casino 2026-08-06
- While ownership has changed over the years 2026-07-18
- Guardian Barrier Services 2026-06-29
- acemacon.org 2026-06-28
- Công ty Cổ phần Công Nghệ Hợp Long 2026-06-12
- WS Group Brasil 2026-06-12
- Australian Medical Council (AMC) 2026-06-12
- INSA INDELMA S.A. 2026-06-12
- Molinos Cabodi Hnos. S.A. 2026-06-12
- Palmero 2026-06-12
- ConsulTIC 2026-06-12
- Town of Jastrebarsko 2026-06-12
- BSynchro Holding 2026-06-12
- Mogren, Glessner & Ahrens Law Firm 2026-06-12