Ankura CTIX FLASH Update - September 15, 2023

Malware Activity

New "3AM" Ransomware Deployed by LockBit Affiliates

Researchers have observed a new ransomware family deployment in conjunction with LockBit ransomware. The deployment of the new ransomware strain "3AM" was proceeded by a command to dump the target system's policy settings for a specific user, which then allowed the threat actors to install certain Cobalt Strike components and continue to escalate privileges using PsExec. If the threat actor failed to install LockBit on a targeted network after escalating privileges, 3AM was pushed for installation instead. 3AM first attempts to halt security and backup tools, before deleting volume shadow copies in an attempt to stop file recovery from occurring post compromise. 3AM then follows the typical pattern of encrypting files, leaving them with the ".threeamtime" extension while also leaving a text file ransom note named "RECOVER-FILES.txt". Additionally, each encrypted file is exfiltrated to an FTP