In recent cyberattacks, when the deployment of the LockBit ransomware failed, attackers resorted to a new ransomware strain named "3AM." This new strain was discovered after hackers used it in an attack that failed to deploy LockBit ransomware on a target network. The 3AM ransomware has been used in a limited manner and was the backup option for attackers when defense mechanisms blocked LockBit.
Symantec's Threat Hunter Team reported that 3AM ransomware attacks are rare, with only a few known instances. The 3AM ransomware encrypts data and leaves a ransom note threatening to sell the stolen data unless a ransom is paid. The ransom note references "3 am" as a mystical time, suggesting that all files have been encrypted and backups have disappeared. The 3AM ransomware is written in Rust and is distinct from other known ransomware families.

Before encrypting files, 3AM tries to halt several services on the infected system related to security and backup products. Once encrypted, files have the ".THREEAMTIME" extension. The malware also tries to delete Volume Shadow copies that could be used for data recovery. Symantec's research indicates that the 3AM ransomware was only partially successful in the attack they studied. The threat actor managed to deploy the malware on three machines, but it was blocked on two of them.

Source:

Tags: #Ransomware #3AM #LockBit #CyberAttack #CyberSecurity #ThreatHunting #Symantec #DataEncryption #BackupAttack

Recent searches

Search options

Administered by:

Server stats:

#dataencryption