ThreeAM (3AM): Exploring the New and Evolving Ransomware that Targets Small and Medium Businesses (SMBs)

Security analysts from Intrinsic discovered a new ransomware variant called ThreeAM that targets small and medium-sized businesses (SMBs). ThreeAM, connected to the R&D of former Conti members and currently affiliated with Royal, uses X/Twitter bots and the Rust language–a less complex but effective strategy. The ransomware campaign, which took place between September 13 and October 26, 2023, targeted twelve US companies by taking advantage of weaknesses in SMEs, one of which being the top pharmacy in Europe, Neuraxpharm. Symantec reveals that ThreeAM emerged as a backup plan after unsuccessful LockBit deployments by connecting it to the Conti-Ryuk-TrickBot nexus. Specifically, ThreeAM removes Volume Shadow copies and appends the ‘.ThreeAMtime’ extension to encrypted files, along with the distinct marker string ‘0x666.’ 

ThreeAM Ransomware Campaign

• Initial Access: The means of ThreeAM entry are currently unknown, but the fact that it appears to behave as backup malware—intervening when a LockBit attack is blocked—indicates possible cooperation with other malicious programs.

• Lateral movement (server targeting): ThreeAM has demonstrated network-wide lateral movement capabilities. They extract data specific to a domain, create a Group Policy Object (GPO), and enact other system changes to increase network access.

• Service Disruption: Before encryption occurs, ThreeAM identifies and stops important system services. The goal of this tactic is to interfere with the victim’s responsiveness and critical network functions.

• File Encryption: Employing the AES-256 algorithm, ThreeAM encrypts files selectively, rendering them inaccessible without the decryption key. It appends the ‘.ThreeAMtime’ extension to every file it encrypts and contains a unique marker string: ‘0x666.’

• Shadow Copy Deletion: To stop data recovery, ThreeAM systematically attempts to erase volume shadow copies (VSS) and backup duplicates of files embedded within the operating system.

• Ransom Demand: After the encryption process, ThreeAM drops a ransom note and extorts victims into remitting payment for the decryption key.

Recommendations

Here are some practical recommendations to mitigate the risks of ThreeAM (3AM) and other emerging threats. 

• Conduct Routine Audits. Conduct audits on a regular basis to find and address any potential for permission abuse on Group Policy Objects (GPOs). Use auditing tools such as BloodHound to help identify potential abuse/misuse of GPO modification privileges. Review GPO permissions regularly to ensure they adhere to the principle of least privilege.

• Improve user account control. Refine and personalize the application scope of GPOs using security filtering and Windows Management Instrumentation (WMI). Reduce the attack surface by implementing security filtering to ensure GPOs are only applied to specific users and systems. Review and update security filtering criteria frequently to account for shifts in user roles and organizational structure.

• Monitor Active Directory for object alterations. Keep an eye out for any unauthorized additions, deletions, or updates to objects in Active Directory, particularly those pertaining to Group Policy. Configure alerts to be notified of changes to AD settings for Windows Event IDs 5137 (Object Creation), 5141 (Object Deletion), and other pertinent events. Establish the standard behavior for AD objects and alert on deviations.

• Create robust ransomware backup and recovery strategies. Take a thoughtful and measured approach to backups, for example, by implementing a “3-2-1” backup strategy: maintain 3 copies of data on 2 different media, with at least 1 copy stored securely offsite. And make sure to:
• Plan automated backups to ensure that important data is consistently captured and to reduce the chance of data loss in the case of an incident. 
• Keep backups off-system to stop attackers from accessing them and corrupting or erasing the data. 
• Improve isolation of backup systems. Think about using physically separated backup storage devices or segregated network segments.
• Address any obstacles with system recovery. Use characteristics like regionally distributed storage and versioning in cloud environments to keep adversaries from impeding system recovery procedures.

• Prioritize endpoint security programs. Use programs that can identify and stop the LockBit and ThreeAM ransomware families. Move beyond basic anti-malware defense. Deploy EDR/XDR solutions that employ behavioral analysis and machine learning to detect and block advanced ransomware variants like 3AM.