Threeam

ThreeAM, a developing ransomware group, was first tracked by GRIT in September 2023. The threat actor responsible initially attempted to deploy the LockBit ransomware encryptor but resorted to using ThreeAM ransomware after the former failed. This shift in strategy came in light of recent law enforcement operations threatening LockBit’s long-term viability and its appeal to affiliates. Symantec’s Threat Hunter Team was the first to identify the ThreeAM ransomware in the wild, recognizing the group's reference to the ThreeAM moniker in their ransom note and encrypted file extensions. In February, ThreeAM posted information from six victim organizations on their data leak site, marking their most active month since the site's launch. They have already leaked stolen data on this Tor leak site, presumably after victims refused to pay the demanded ransom. One notable incident involved Kootenai Health, who disclosed a data breach impacting over 464,088 patients following the leak of their personal information by the ThreeAM ransomware gang. While there is no current evidence suggesting that ThreeAM operates as a Ransomware-as-a-Service (RaaS) operation, an observed increase in operational tempo since their data leak site's launch may indicate an improvement in the quality or quantity of their operations. Over time, ThreeAM could emerge as one of several viable alternatives to LockBit, potentially leading to a continued increase in the group's victim volume in the coming months.