Rust-Written 3AM Ransomware: A Sneak Peek into a New Malware Family

Sep 13, 2023THNRansomware / Malware

A caller ransomware household called 3AM has emerged successful the chaotic aft it was detected successful a azygous incidental successful which an unidentified affiliate deployed the strain pursuing an unsuccessful effort to deploy LockBit (aka Bitwise Spider oregon Syrphid) successful the people network.

"3AM is written successful Rust and appears to beryllium a wholly caller malware family," the Symantec Threat Hunter Team, portion of Broadcom, said successful a study shared with The Hacker News.

"The ransomware attempts to halt aggregate services connected the infected machine earlier it begins encrypting files. Once encryption is complete, it attempts to delete Volume Shadow (VSS) copies."

3AM gets its sanction from the information that it's referenced successful the ransom note. It besides appends encrypted files with the hold .threeamtime. That said, it's presently not known if the malware authors person immoderate connections with known e-crime groups.

In the onslaught spotted by Symantec, the adversary is said to person managed to deploy the ransomware to 3 machines connected the organization's network, lone for it to beryllium blocked connected 2 of those machines.

The intrusion is notable for utilizing Cobalt Strike for post-exploitation and privilege escalation, pursuing it up by moving reconnaissance commands to place different servers for lateral movement. The nonstop ingress way employed successful the onslaught is unclear.

"They besides added a caller idiosyncratic for persistence and utilized the Wput instrumentality to exfiltrate the victims' files to their ain FTP server," Symantec noted.

A 64-bit executable written successful Rust, 3AM is engineered to tally a bid of commands to halt assorted information and backup-related software, encrypt files matching predefined criteria, and purge measurement shadiness copies.

Dive heavy into the aboriginal of SaaS information with Maor Bin, CEO of Adaptive Shield. Discover wherefore individuality is the caller endpoint. Secure your spot now.

While the nonstop origins of the ransomware remains unknown, determination is grounds that the ransomware affiliate connected to the cognition is targeting different entities, according to a post shared connected Reddit connected September 9, 2023.

"Ransomware affiliates person go progressively autarkic from ransomware operators," Symantec said.

"New ransomware families look often and astir vanish conscionable arsenic rapidly oregon ne'er negociate to summation important traction. However, the information that 3AM was utilized arsenic a fallback by a LockBit affiliate suggests that it whitethorn beryllium of involvement to attackers and could beryllium seen again successful the future."

Found this nonfiction interesting? Follow america connected Twitter  and LinkedIn to work much exclusive contented we post.