Rust-Written 3AM Ransomware: A Sneak Peek into a New Malware Family

A new ransomware household referred to as 3AM has emerged in the wild following it was detected in a one incident in which an unknown affiliate deployed the strain following an unsuccessful try to deploy LockBit (aka Bitwise Spider or Syrphid) in the target network.

“3AM is prepared in Rust and seems to be a completely new malware relatives,” the Symantec Danger Hunter Team, element of Broadcom, mentioned in a report shared with The Hacker Information.

“The ransomware makes an attempt to cease a number of providers on the contaminated personal computer in advance of it starts encrypting documents. After encryption is entire, it attempts to delete Quantity Shadow (VSS) copies.”

3AM gets its identify from the point that it’s referenced in the ransom note. It also appends encrypted files with the extension .threeamtime. That stated, it can be presently not recognised if the malware authors have any connections with recognised e-criminal offense groups.

In the attack spotted by Symantec, the adversary is said to have managed to deploy the ransomware to 3 devices on the organization’s network, only for it to be blocked on two of people machines.

The intrusion is notable for utilizing Cobalt Strike for post-exploitation and privilege escalation, subsequent it up by jogging reconnaissance commands to establish other servers for lateral motion. The precise ingress route employed in the attack is unclear.

“They also additional a new user for persistence and made use of the Wput device to exfiltrate the victims’ information to their personal FTP server,” Symantec pointed out.

A 64-bit executable written in Rust, 3AM is engineered to run a sequence of commands to prevent different security and backup-related software package, encrypt files matching predefined conditions, and purge quantity shadow copies.

Upcoming WEBINARIdentity is the New Endpoint: Mastering SaaS Security in the Modern day Age

Dive deep into the potential of SaaS security with Maor Bin, CEO of Adaptive Shield. Find why id is the new endpoint. Secure your place now.

Supercharge Your Capabilities

Even though the actual origins of the ransomware stays unidentified, there is proof that the ransomware affiliate connected to the operation is targeting other entities, according to a article shared on Reddit on September 9, 2023.

“Ransomware affiliates have turn into significantly unbiased from ransomware operators,” Symantec claimed.

“New ransomware people surface usually and most vanish just as promptly or by no means take care of to acquire substantial traction. Having said that, the truth that 3AM was made use of as a fallback by a LockBit affiliate implies that it may well be of desire to attackers and could be observed again in the potential.”

Found this report fascinating? Adhere to us on Twitter  and LinkedIn to examine more exclusive content material we post.

Some parts of this article are sourced from:
thehackernews.com