Hunt / threeam
3AM
11victims, 90d
Oct 9last post
0reports about them
-techniques with a rule
0indicators
Nothing published that we can read says how 3AM gets in or what it runs once inside. This page is who they hit, and that is all we have. If you know of a public write-up, it belongs here.
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-10-09 | fleetworksinc.com | US |
| 2026-09-28 | safescaffolding.net | GB |
| 2026-09-28 | coosalud.com | CO |
| 2026-09-28 | pistonespersan.com.ar | AR |
| 2026-09-28 | midwestbit.com | US |
| 2026-09-28 | apexus.com | US |
| 2026-09-28 | bhn-expertise.com | DE |
| 2026-09-28 | stjames.wa.edu.au | AU |
| 2026-09-21 | newmantractor.com | US |
| 2026-08-30 | wmdn.net | MD |
| 2026-08-19 | mecasem.org | MX |
Latest 11 of 11, from ransomware.live. These are the group's claims.
Confirmed elsewhere
Victims of 3AM that a second, independent source also named inside two weeks. How convergence works.
- 2026-09-04 Mogren, Glessner & Ahrens, P.S. leak + notice
Sweep
No indicators. Either nobody has published any for 3AM, or the reports cite values without marking them as IOCs. package.json