3am
ransomware group · aka 3AM, ThreeAM · unknown (no confirmed country of origin in public reporting) · active since 2023-09 (first observed in the wild; documented by SentinelOne and Sophos in October 2023)
Victims · 7d
0flat
Victims · 30d
2active targets
Victims · 90d
6
All-time (tracked)
96since 2023-09-17
Last post
08-29 01:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
3AM (ThreeAM) is a low-volume double-extortion ransomware group named for the '3 am' opener of its ransom notes, whose initial Windows encryptor was written in Rust. It drew attention in October 2023 when Sophos documented an affiliate deploying 3AM as a fallback after a failed LockBit deployment, including the unusual tactic of emailing and phoning victims to apply pressure. Operations are affiliate-style, with data exfiltration before encryption and leak-site publication used for extortion; vendor research has also noted tooling and TTP overlaps with the Fog ransomware group, though the relationship is not confirmed. Public reporting has not established the group's origin, typical initial-access vectors, or victim earnings. Dashboard tracking shows 18 leak-site victims since 2026-06-12 (2 in the last 30 days), with the most recent post on 2026-08-29.
Tactics & tooling
- Deploys Rust-based Windows ransomware; notes open with '3 am' (SentinelOne/Sophos, 2023)
- Double extortion: data exfiltration before encryption, leak-site publication for pressure
- Directly contacts victims by email and phone calls when leak-site pressure fails (Sophos, 2023)
- Affiliate-style deployment; observed as fallback after a failed LockBit affiliate attempt (Sophos, 2023)
- Clears event logs and deletes volume shadow copies to impede recovery (vendor reporting, 2023)
- Uses legitimate remote-access and file-transfer utilities for operations (e.g., putty, FileZilla)
- Reported tooling/TTP overlap with Fog ransomware; relationship unconfirmed (vendor research, 2024)
- Initial access vectors and exploited CVEs not consistently attributed in public reporting
Targeted sectors
manufacturinghospitality and gaminggovernment (local)professional and IT servicesagriculture and food
Notable public victims
jastrebarsko.hr (Town of Jastrebarsko, Croatia), clubonecasino.com, molinoscabodi.com.ar, bsynchro.com, mecasem.org, jetmachprod.com, insamani.com.ar, palmero.com, wmdn.net, tws-tac.net
Estimated earnings
No public figure.
Leak-site victims96 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| wmdn.net | · 17d ago | Twin States News is a media organization that provides comprehensive coverage of local, state, national, and world news. Their services include reporting on various topics such as crime, education, health, politics, and community events. The inten | PUBLISHED 1% | Views: 43 |
| mecasem.org | · 28d ago | The group gives quality and reliability the highest priority in the through execution of all its business activities. Therefore MECASEM provides a wide range of solutions ISO 17025 (COFRAC) accredited and EN 9100 and ISO 9001 certified. Since 2012 | PUBLISHED 1% | Views: 33 |
| clubonecasino.com | · Aug 5, 2026 | Club One Casino is the premier poker room in Central California, featuring 51 table games, a 24-hour restaurant, and extensive non-gaming entertainment options such as sporting events and e-Sports. Catering to both seasoned players and newcomers, | PUBLISHED 1% | Views: 18 |
| tws-tac.net | · Jul 8, 2026 | While ownership has changed over the years, the company has remained locally owned for over 65 years and family-owned for almost 40 years. The company is proud of the company's history and look forward to the future as the company continue to serv | PUBLISHED 1% | Views: 39 |
| guardianbarrierservices.com | · Jun 29, 2026 | Guardian Barrier Services provides a wide range of products and services for events, including crowd control barriers, cable ramps, truss structures, and temporary flooring. Their experienced team supports clients from the planning stage to the ex | PUBLISHED 0% | Views: 16 |
| acemacon.org | · Jun 27, 2026 | The Academy for Classical Education is dedicated to fostering knowledge and critical thinking skills in children, preparing them to be independent learners for life. It offers a comprehensive educational experience that includes fine arts, athleti | PUBLISHED 0% | Views: 10 |
| jetmachprod.com | · Jun 12, 2026 | Jet Machined Products specializes in high-performance milled and turned components for the aerospace, instrumentation, robotics, and other specialized industries. With decades of experience, they focus on precision manufacturing to meet exacting t |
| jastrebarsko.hr | · Jun 12, 2026 | Town of Jastrebarsko, a historic city in Central Croatia located between Zagreb and Karlovac. |
| palmero.com | · Jun 12, 2026 | Palmero is a company dedicated to the manufacturing and marketing of capital goods, providing comprehensive solutions across various segments including energy, oil and gas, mining, agriculture, and construction. With 75 years of presence in Argent |
| insamani.com.ar | · Jun 12, 2026 | INSA INDELMA S.A. is a leading agro-industrial company in Argentina specializing in peanut production, exporting 80% of its output to over 30 countries worldwide. The company emphasizes quality through a comprehensive traceability system that ensu |
| bsynchro.com | · Jun 12, 2026 | BSynchro Holding is an insurtech software provider that specializes in innovative insurance solutions tailored for insurance companies, brokers, and reinsurance brokers. Their product offerings include advanced tools such as CORA for product confi |
| molinoscabodi.com.ar | · Jun 12, 2026 | Molinos Cabodi Hnos. S.A. has been providing high-quality flour products since 1853, including various types of flour such as Harina 000, Harina 000 Pan de Miga, and semolina. The company serves clients across the MERCOSUR region, offering persona |
| ws.com.br | · Jun 12, 2026 | WS Group Brasil is a Brazilian operations and business services provider engaged in logistics, technical support, contract administration, and labor-intensive service delivery. The company serves a mix of government, institutional, and commercial |
| consultic.be | · Jun 12, 2026 | ConsulTIC specializes in IT solutions, offering services such as application hosting, virtualization, telecommuting support, and security solutions. Their target clients include businesses seeking reliable, high-performance, and secure IT services |
| amc.org.au | · Jun 12, 2026 | The Australian Medical Council (AMC) is an independent national standards body responsible for the accreditation and assessment of medical education and training in Australia and New Zealand. Its primary purpose is to ensure that the standards of |
| agroexportavocados.com | · Jun 12, 2026 | Agro Industrial Exportadora SA de CV (AGRIEXP) is a Mexican holding company which is engaged in the food processing sector. Through its subsidiaries, the Company purchases, processes and sells fruit and vegetables. |
| hoplongtech.com | · Jun 12, 2026 | Công ty Cổ phần Công Nghệ Hợp Long is a leading distributor of automation equipment and industrial robotics solutions in Vietnam, representing brands such as Schneider Electric, Siemens, Omron, Veichi, NiSTRO, Leipole, and Universal Robots. They o |
| mgrlaw.com | · Jun 12, 2026 | Mogren, Glessner & Ahrens Law Firm is a full-service law firm located in King County, specializing in family law, divorce, probate, wills, criminal defense, personal injury, and adoption. Established in 1942, the firm is dedicated to providing com |
| aceforwarding.com | · Nov 25, 2025 | Ace Forwarding started out in 1994 as a small operation with a single truck picking up and delivering to and from the Detroit airport, fulfilling our customers time-critical shipments and becoming the go-to logistics operation when time was of the |
| ic-controls.com | · Nov 18, 2025 | Industrial Controls SAC, desde 1994 ofrece a nivel nacional, desarrollo e implementación de proyectos integrales y soluciones en electricidad, instrumentación, neumática y automatización industrial. Comprometidos con la calidad del trabajo que des |
| bun.nl | · Oct 16, 2025 | Bun creëert woon-, werk- en leefruimte voor iedereen en van de beste kwaliteit. Wij spelen in op zaken die leven in de maatschappij. De behoefte hierin aan woningen in is groot. Daarom houden wij ons bezig met de ontwikkeling en het renoveren van |
| hsjlawyers.com | · Oct 2, 2025 | Founded in 1971, HSJ Lawyers is a prominent law firm located in Prince George, British Columbia, serving the legal needs of clients throughout Northern BC. With a team of 15 lawyers and 25 staff members, the firm specializes in various areas including business law, family law, employment law, personal injury law, real estate, and criminal law. HSJ Lawyers is known for its community involvement and is recognized as one of the largest and most comprehensive law firms in the region. Their clientele includes both individuals and businesses seeking trusted, local, and experienced legal representation. |
| townofnorwell.net | · Sep 4, 2025 | The Town of Norwell MA offers a variety of municipal services including animal control, building permits, health clinics, and recreational programs. It serves the residents of Norwell by ensuring public safety, facilitating community events, and providing resources for aging individuals. The town focuses on promoting a multigenerational community through initiatives like the Community Center Project. Furthermore, Norwell is engaged in environmental conservation and provides housing and transportation services to its citizens. |
| curedentalbeltontx.com | · Sep 4, 2025 | Cure Dental is a company that operates in the Dental Offices industry. It employs 10to19 people and has 1Mto5M of revenue. The company is headquartered in Belton, Texas. |
| austinplasticandreconstructivesurgery.com | · Sep 4, 2025 | Austin Plastic Reconstructive Surgery, led by Board-Certified Plastic Surgeon Dr. Christine Fisher, specializes in breast reconstruction and a variety of cosmetic surgery procedures. The clinic caters to individuals seeking to enhance their beauty and restore confidence, particularly women recovering from breast cancer. Their offerings include breast, body, and facial procedures, as well as advanced medspa treatments for skin rejuvenation. The team is committed to providing personalized care and transformative results in a welcoming environment. |
| sequoiadental.com | · Jul 19, 2025 | Sequoia Dental Office provides a wide range of dental services including general, cosmetic, orthodontic, and restorative dentistry. Located in Visalia, CA, they are dedicated to patient comfort and use advanced technology to enhance care, offering |
| wyomingcountyny.gov | · Jun 28, 2025 | — |
| vazirilaw.com | · May 25, 2025 | — |
| gosvt.com | · Apr 10, 2025 | — |
| neffendorfblockercpa.com | · Apr 10, 2025 | — |
| jastreet.com | · Apr 10, 2025 | — |
| icmtx.com | · Apr 10, 2025 | — |
| dbhcares.com | · Apr 10, 2025 | — |
| icgad.com | · Apr 10, 2025 | — |
| iss-na.com | · Apr 10, 2025 | — |
| kkp.law | · Apr 10, 2025 | — |
| leonardo.com | · Feb 13, 2025 | — |
| sehma.com | · Feb 12, 2025 | — |
| corehandf.com | · Feb 5, 2025 | — |
| soitinlaine.fi | · Jan 30, 2025 | — |
| anwsd.org | · Jan 15, 2025 | — |
| hapsch.de | · Jan 9, 2025 | — |
| kuritaamerica.com | · Dec 17, 2024 | — |
| hobokennj.gov | · Dec 4, 2024 | — |
| midstatesindustrial.com | · Nov 13, 2024 | — |
| anuenterprise.com.au | · Oct 31, 2024 | — |
| inhometexas.com | · Oct 31, 2024 | — |
| caillau.com.br | · Oct 31, 2024 | — |
| sandray.com | · Oct 31, 2024 | — |
| mpspromotions.com | · Oct 31, 2024 | — |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .