3AM
A ransomware family first reported in September 2023, when an affiliate used it after LockBit was blocked. In a 2025 case, its actors flooded an employee with email, called them posing as IT, then ran a hidden virtual machine to stay out of sight of security tools.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Symantec first reported 3AM after an affiliate tried LockBit and switched to 3AM when it was blocked.2 That tells defenders that blocking one encryptor may not end an attack in progress.
The clearest recent case comes from Sophos. In the first quarter of 2025, actors signed an employee up for mailing lists, called while spoofing the IT department's number, and persuaded them to allow a Quick Assist session. They then ran a virtual machine that application control did not block, hiding early activity from endpoint tools. About 868 GB of data left the network before a mostly blocked encryption attempt on day nine.3
Attribution is less firm. Intrinsec considered 3AM likely connected to Royal, now BlackSuit, and Conti.5 Sophos also cites assessments of a BlackSuit link, and says leaked Black Basta chats connect 3AM to vishing actors.3 These are assessments, not confirmed facts. Not every claim holds up: in June 2026 an organisation publicly denied a 3AM listing and said the published data was not its own.4 The sources reviewed do not establish a UK link.
A flood of spam followed by a helpful phone call has become a recognisable pattern. We would make sure staff know to treat it as a warning, and check whether your application control would stop a portable virtual machine.
How It Attacks
Based on one Sophos incident from the first quarter of 2025.3 Earlier reporting shows other methods, including Cobalt Strike,2 so affiliates may differ.
- 1
Research the Target
Gathers employee email addresses and the internal IT department's phone number.
- 2
Flood the Inbox
Signs the target up to mailing lists, producing a sudden burst of email.
- 3
Call as IT
Spoofs the IT department's number and persuades the employee to open Quick Assist.
- 4
Hide in a Virtual Machine
Runs a QEMU virtual machine containing a backdoor, which connects outwards.
- 5
Take Over Accounts
Compromises service and domain admin accounts, creates a local admin and installs an RMM tool.
- 6
Move and Steal
Moves using RDP, WMIC and remote PowerShell, and uploads data using GoodSync.
- 7
Try to Encrypt
Runs the ransomware from a server without endpoint protection, aiming at other machines.
Key Techniques
ATT&CK v20 has no group entry for 3AM. This mapping is ours, based on Sophos3 and Symantec's findings as reported.2
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1667 | Email Bombing | Impact | Floods the target's inbox. |
| T1566.004 | Spearphishing Voice | Initial Access | Calls while spoofing the IT department. |
| T1219.002 | Remote Desktop Software | Command and Control | Uses Quick Assist and an RMM tool. |
| T1564.006 | Run Virtual Instance | Stealth | Hides activity in a QEMU virtual machine. |
| T1136.001 | Local Account | Persistence | Creates a local admin account. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves over RDP. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Uploads data to Backblaze. |
| T1490 | Inhibit System Recovery | Impact | Deletes volume shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files. |
Tools Observed
Remote Access
Malware and Evasion
Data Theft
From Sophos3 and Symantec's findings.2 Many are legitimate products, so check whether a tool is approved and expected.
Vulnerabilities
The sources reviewed tie no specific CVE to 3AM.1
Warning Signs
Drawn from Sophos.3 None of these proves an attack alone.
- Dozens of unsolicited emails to one person in minutes
- A call from the IT department that IT did not make
- Quick Assist sessions after an unsolicited call
- QEMU or other portable virtual machines on an endpoint
- Attempts to remove MFA software or deploy an EDR killer
- GoodSync on servers
Defences That Matter
Set Expectations for IT Calls
- Teach staff how IT will and will not contact them, and which remote tools it uses.3
Block What Should Not Run
- Block unapproved tools, including virtual machines like QEMU and RMM tools.3
- Restrict PowerShell to admins and signed scripts.3
Tighten Accounts
- Use strong admin and service passwords, and least privilege.3
- Restrict service accounts that lack MFA by logon time and privilege.3
Close Network Paths
- Limit RDP to designated servers and block remote access ports to critical segments.3
- Protect every server, as this attack ran from the one that had no endpoint protection.3
What Would Your Staff Do After an Email Flood and a Call From IT?
We can test how your people and endpoint controls respond to the methods in this profile.
Sources
- Blackpoint Cyber: ThreeAM Ransomware threat profile, 15 December 2025
- SecurityWeek: LockBit Affiliate Deploys New 3AM Ransomware in Recent Attack, September 2023
- Sophos X-Ops: A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist, 20 May 2025
- Cyber Daily: report on a denied ThreeAM claim, 16 June 2026
- BleepingComputer: Researchers link 3AM ransomware to Conti, Royal cybercrime gangs, 20 January 2024
- Dark Reading: 3AM Ransomware Adopts Email Bombing, Vishing Combo Attack, 22 May 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.