{"id":227679,"date":"2024-01-19T16:40:00","date_gmt":"2024-01-19T15:40:00","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=227679"},"modified":"2024-01-19T16:40:00","modified_gmt":"2024-01-19T15:40:00","slug":"threeam-ransomware","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/threeam-ransomware\/","title":{"rendered":"ThreeAM ransomware"},"content":{"rendered":"<p>[et_pb_section fb_built= \u00bb1\u2033 _builder_version= \u00bb4.16\u2033 global_colors_info= \u00bb{} \u00bb][et_pb_row column_structure= \u00bb1_2,1_2\u2033 _builder_version= \u00bb4.16\u2033 _module_preset= \u00bbdefault \u00bb custom_margin= \u00bb|6px||6px|| \u00bb custom_padding= \u00bb17px|0px|||| \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_column type= \u00bb1_2\u2033 _builder_version= \u00bb4.16\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_text _builder_version= \u00bb4.23.1\u2033 _module_preset= \u00bbdefault \u00bb text_font= \u00bb|600||||||| \u00bb header_font= \u00bb|600||||||| \u00bb custom_margin= \u00bb-15px||-1px||false|false \u00bb custom_padding= \u00bb0px||||| \u00bb global_colors_info= \u00bb{} \u00bb]<\/p>\n<h1 class=\"entry-title\">ThreeAM ransomware<\/h1>\n<p>[\/et_pb_text][et_pb_text _builder_version= \u00bb4.22.2\u2033 _module_preset= \u00bbdefault \u00bb text_text_color= \u00bb#000000\u2033 custom_margin= \u00bb|68px|||| \u00bb custom_padding= \u00bb27px|0px|||| \u00bb global_colors_info= \u00bb{} \u00bb]<\/p>\n<h2><a name=\"_Toc146724916\"><\/a>Key findings<\/h2>\n<p>This report presents:<\/p>\n<ul>\n<li>Intrinsec&#039;s CTI analysts unveil a new extortion scheme being tested by ThreeAM via X (previously known as Twitter). Bots could have been used to automatically name and shame amongst followers of its victims&#039; official X accounts.<\/li>\n<li>We found that the intrusion set intended to set up a dedicated leak site on the clear web.<\/li>\n<li>We successfully deanonymized the website server used by the intrusion set and found overlaps with the Russian-speaking top tier ransomware ecosystem. We assess it is likely that ThreeAM ransomware works under the wing of the reorganized Conti syndicate (Conti&#039;s former TEAM 2, now known as Royal). As shown in the literature, a relationship with Zeon members (former TEAM1) is possible.<\/li>\n<li>We found a close match with the backend infrastructure used by IcedID malware being deployed by several initial access broker (IAB) known to fuel the ransomware ecosystem such as ALPHV\/BlackCat.<\/li>\n<li>intrusion set first attempted to deploy LockBit ransomware payloads and used a new Rust-based ransomware called ThreeAM as a fallback.<\/li>\n<li>Some findings also suggest that LockBit ransomware-as-a-service could be used, in some instances, as a possible smokescreen for cyberespionage and intellectual theft operations by a couple of intrusion sets tied to Russian and Chinese intelligence (Evil Corp and Bronze Starlight, respectively).<\/li>\n<\/ul>\n<h2><a name=\"_Toc146724917\"><\/a>Intrinsec&#039;s CTI services<\/h2>\n<p>Organizations are facing a rise in the sophistication of threat actors and intrusion sets. To address these evolving threats, it is now necessary to take a proactive approach in the detection and analysis of any element deemed malicious. Such a hands-on approach allows companies to anticipate, or at least react as quickly as possible to the compromises they face.<\/p>\n<p>For this report, shared with our clients in July 2023, Intrinsec relied on its Cyber Threat Intelligence service, which provides its customers with high value-added, contextualized and actionable intelligence to understand and contain cyber threats. Our CTI team consolidates data &amp; information gathered from our security monitoring services (SOC, MDR, etc.), our incident response team (CERT-Intrinsec) and custom cyber intelligence generated by our analysts using custom heuristics, honeypots, hunting, reverse-engineering &amp; pivots.<\/p>\n<p>Intrinsec also offers various services around Cyber Threat Intelligence:<\/p>\n<ul>\n<li>Risk anticipation: which can be leveraged to continuously adapt the detection &amp; response capabilities of our clients&#039; existing tools (EDR, XDR, SIEM, \u2026) through:<\/li>\n<ul>\n<li><strong>an operational feed of IOCs based on our exclusive activities.<\/strong><\/li>\n<li><strong>threat intel notes &amp; reports, TIP-compliant.<\/strong><\/li>\n<\/ul>\n<li>Digital risk monitoring:<\/li>\n<ul>\n<li><strong>data leak detection &amp; remediation<\/strong><\/li>\n<li><strong>external asset security monitoring (EASM)<\/strong><\/li>\n<li><strong>brand protection<\/strong><\/li>\n<\/ul>\n<\/ul>\n<p>For more information, go to <a href=\"http:\/\/www.intrinsec.com\/en\/cyber-threat-intelligence\/\">htbqccsz.elementor.cloud\/en\/cyber-threat-intelligence\/<\/a>.<\/p>\n<p>Follow us on <a href=\"https:\/\/www.linkedin.com\/company\/intrinsec\/\">LinkedIn<\/a> and <a href=\"https:\/\/twitter.com\/Intrinsec\">Twitter<\/a><\/p>\n<p>[\/et_pb_text][et_pb_button button_url=&quot;https:\/\/www.intrinsec.com\/wp-content\/uploads\/2024\/01\/TLP-CLEAR-2024-01-09-ThreeAM-EN-Information-report.pdf&quot; button_text=&quot;Continue reading&quot; _builder_version=&quot;4.23.1&quot; _module_preset=&quot;default&quot; custom_button=&quot;on&quot; button_border_radius=&quot;40px&quot; button_icon=&quot;\ue092||divi||400&quot; hover_enabled=&quot;0&quot; box_shadow_style=&quot;preset1&quot; global_colors_info=&quot;{}&quot; sticky_enabled=&quot;0&quot;][\/et_pb_button][\/et_pb_column][et_pb_column type=&quot;1_2&quot; _builder_version=&quot;4.16&quot; _module_preset=&quot;default&quot; global_colors_info=&quot;{}&quot;][et_pb_image src=&quot;https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/Dec2023-scaled.jpg&quot; alt=&quot;ThreeAM&quot; title_text=&quot;ThreeAM&quot; align=&quot;center&quot; _builder_version=&quot;4.23.1&quot; _module_preset=&quot;default&quot; width=&quot;76%&quot; module_alignment=&quot;center&quot; global_colors_info=&quot;{}&quot;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&quot;4.16&quot; _module_preset=&quot;default&quot; global_colors_info=&quot;{}&quot;][et_pb_column type=&quot;4_4&quot; _builder_version=&quot;4.16&quot; _module_preset=&quot;default&quot; global_colors_info=&quot;{}&quot;][et_pb_text _builder_version=&quot;4.16&quot; _module_preset=&quot;default&quot; text_font=&quot;|600|||||||&quot; text_font_size=&quot;35px&quot; text_orientation=&quot;center&quot; global_colors_info=&quot;{}&quot;]<\/p>\n<p>Other analysis<\/p>\n<p>[\/et_pb_text] \u00bb1584\u2033 excerpt_length= \u00bb150\u2033 show_author= \u00bboff \u00bb show_date= \u00bboff \u00bb show_categories= \u00bboff \u00bb masonry_tile_background_color= \u00bbRGBA(255,255,255,0) \u00bb _builder_version= \u00bb4.16\u2033 _module_preset= \u00bbdefault \u00bb header_font= \u00bb|600||||||| \u00bb body_font= \u00bb|300||||||| \u00bb body_text_color= \u00bb#000000\u2033 width= \u00bb80% \u00bb module_alignment= \u00bbcenter \u00bb custom_margin= \u00bb|||0px|false|false \u00bb custom_padding= \u00bb0px|||0px|false|false \u00bb animation_style= \u00bbfade \u00bb animation_duration= \u00bb2000ms \u00bb enable_grid_motion= \u00bbon \u00bb border_radii= \u00bbon|20px|20px|20px|20px \u00bb border_width_top= \u00bb0px \u00bb border_color_top= \u00bbRGBA(255,255,255,0) \u00bb box_shadow_style= \u00bbpreset1\u2033 box_shadow_blur= \u00bb14px \u00bb box_shadow_spread= \u00bb-3px \u00bb global_colors_info= \u00bb{} \u00bb][\/et_pb_blog][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built= \u00bb1\u2033 _builder_version= \u00bb4.16\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_row column_structure= \u00bb1_2,1_2\u2033 admin_label= \u00bb12 Days of Christmas \u2013 Day 05 Contact Form Module 1\u2033 _builder_version= \u00bb4.16\u2033 background_size= \u00bbinitial \u00bb background_position= \u00bbtop_left \u00bb background_repeat= \u00bbrepeat \u00bb max_width= \u00bb1516px \u00bb custom_margin= \u00bb||100px||false|false \u00bb custom_padding= \u00bb50px|30px|50px|64px|false|false \u00bb custom_css_main_element= \u00bb z-index: 9; \u00bb border_radii= \u00bbon|10px|10px|10px|10px \u00bb box_shadow_style= \u00bbpreset1\u2033 box_shadow_blur= \u00bb10px \u00bb use_custom_width= \u00bbon \u00bb custom_width_px= \u00bb1516px \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_column type= \u00bb1_2\u2033 _builder_version= \u00bb4.16\u2033 custom_padding= \u00bb6px||| \u00bb global_colors_info= \u00bb{} \u00bb custom_padding__hover= \u00bb||| \u00bb][et_pb_text admin_label= \u00bbLorem Ipsum \u00bb _builder_version= \u00bb4.16\u2033 text_font= \u00bbLato|||on||||| &quot; text_text_color=&quot;#a7a7a7&quot; text_font_size=&quot;16px&quot; custom_margin=&quot;|0%|-20px|0px&quot; custom_padding=&quot;0%|0%|0%|0%&quot; custom_css_main_element=&quot;float: none !important;&quot; global_colors_info=&quot;{}&quot;][\/et_pb_text][et_pb_cta title=&quot;Don&#039;t hesitate to contact us&quot; button_url=&quot;\/nos-expertises-en-securite-informatique\/&quot; button_text=&quot;Discover our expertise&quot; admin_label=&quot;Where do you want to go today?&quot; _builder_version=&quot;4.16&quot; header_font=&quot;Poppins|500||||||| \u00bb header_text_align= \u00bbleft \u00bb header_text_color= \u00bb#000000\u2033 header_font_size= \u00bb32px \u00bb header_letter_spacing= \u00bb0.6px \u00bb header_line_height= \u00bb120% \u00bb body_font= \u00bbPoppins|||||||| \u00bb body_text_color= \u00bb#000000\u2033 body_font_size= \u00bb17px \u00bb body_line_height= \u00bb30px \u00bb use_background_color= \u00bboff \u00bb custom_button= \u00bbon \u00bb button_text_size= \u00bb18px \u00bb button_text_color= \u00bb#ffffff \u00bb button_bg_color= \u00bb#c41718\u2033 button_border_width= \u00bb1px \u00bb button_border_color= \u00bb#c41718\u2033 button_border_radius= \u00bb40px \u00bb button_font= \u00bbMontserrat|500||||||| \u00bb button_use_icon= \u00bboff \u00bb button_alignment= \u00bbleft \u00bb text_orientation= \u00bbleft \u00bb background_layout= \u00bblight \u00bb max_width= \u00bb568px \u00bb max_width_tablet= \u00bb100% \u00bb max_width_phone= \u00bb \u00bb max_width_last_edited= \u00bbon|tablet \u00bb custom_margin= \u00bb30px||| \u00bb custom_margin_tablet= \u00bb \u00bb custom_margin_phone= \u00bb||| \u00bb custom_margin_last_edited= \u00bbon|desktop \u00bb custom_padding= \u00bb||| \u00bb header_font_size_tablet= \u00bb30px \u00bb header_font_size_phone= \u00bb26\u2033 header_font_size_last_edited= \u00bbon|phone \u00bb header_line_height_tablet= \u00bb \u00bb header_line_height_phone= \u00bb \u00bb header_line_height_last_edited= \u00bbon|desktop \u00bb body_font_size_tablet= \u00bb \u00bb body_font_size_phone= \u00bb \u00bb body_font_size_last_edited= \u00bbon|phone \u00bb button_text_size_tablet= \u00bb \u00bb button_text_size_phone= \u00bb17px \u00bb button_text_size_last_edited= \u00bbon|phone \u00bb custom_css_promo_button= \u00bbpadding: 11px 2.2vw !important;||margin-top: 37px !important; \u00bb custom_css_promo_title= \u00bb font-weight: 400;|| padding-bottom: 18px; \u00bb box_shadow_style_button= \u00bbpreset1\u2033 button_text_color_hover= \u00bb#c41718\u2033 button_border_color_hover= \u00bb#c41718\u2033 button_border_radius_hover= \u00bb2px \u00bb button_bg_color_hover= \u00bb#ffffff \u00bb global_colors_info= \u00bb{} \u00bb button_text_size__hover_enabled= \u00bboff \u00bb button_one_text_size__hover_enabled= \u00bboff \u00bb button_two_text_size__hover_enabled= \u00bboff \u00bb button_text_color__hover_enabled= \u00bbon \u00bb button_text_color__hover= \u00bb#c41718\u2033 button_one_text_color__hover_enabled= \u00bboff \u00bb button_two_text_color__hover_enabled= \u00bboff \u00bb button_border_width__hover_enabled= \u00bboff \u00bb button_one_border_width__hover_enabled= \u00bboff \u00bb button_two_border_width__hover_enabled= \u00bboff \u00bb button_border_color__hover_enabled= \u00bbon \u00bb button_border_color__hover= \u00bb#c41718\u2033 button_one_border_color__hover_enabled= \u00bboff \u00bb button_two_border_color__hover_enabled= \u00bboff \u00bb button_border_radius__hover_enabled= \u00bbon|desktop \u00bb button_border_radius__hover= \u00bb40px \u00bb button_one_border_radius__hover_enabled= \u00bboff \u00bb button_two_border_radius__hover_enabled= \u00bboff \u00bb button_letter_spacing__hover_enabled= \u00bboff \u00bb button_one_letter_spacing__hover_enabled= \u00bboff \u00bb button_two_letter_spacing__hover_enabled= \u00bboff \u00bb button_bg_color__hover_enabled= \u00bbon \u00bb button_bg_color__hover= \u00bb#ffffff \u00bb button_one_bg_color__hover_enabled= \u00bboff \u00bb button_two_bg_color__hover_enabled= \u00bboff \u00bb]<\/p>\n<p>Leave us a message describing your security needs, or contact us if you would like information about our activities. We will respond as soon as possible.<\/p>\n<p><strong><span style=\"color: #a51717;\">Don&#039;t forget to provide your email address or phone number so we can get back to you quickly.<\/span>\u00a0<\/strong><\/p>\n<p>[\/et_pb_cta][\/et_pb_column][et_pb_column type= \u00bb1_2\u2033 _builder_version= \u00bb4.16\u2033 custom_padding= \u00bb||| \u00bb global_colors_info= \u00bb{} \u00bb custom_padding__hover= \u00bb||| \u00bb][et_pb_contact_form captcha= \u00bboff \u00bb email= \u00bbcontact@intrinsec.com \u00bb success_message= \u00bbYour message has been sent \u00bb submit_button_text= \u00bbSend \u00bb admin_label= \u00bbDay 05 Contact Form Module 1\u2033 module_id= \u00bbet_pb_contact_form_1\u2033 _builder_version= \u00bb4.16\u2033 _unique_id= \u00bb538efec8-3317-4a98-b5a1-5cf0b096fc6d \u00bb form_field_background_color= \u00bb#ffffff \u00bb form_field_text_color= \u00bb#b3b3b3\u2033 form_field_focus_text_color= \u00bb#000000\u2033 title_font= \u00bbPoppins|700||||||| \u00bb title_text_align= \u00bbleft \u00bb title_text_color= \u00bb#000000\u2033 title_font_size= \u00bb24\u2033 title_letter_spacing= \u00bb0.6px \u00bb form_field_font= \u00bbPoppins|||||||| \u00bb form_field_text_align= \u00bbleft \u00bb form_field_font_size= \u00bb16px \u00bb background_color= \u00bb#ffffff \u00bb custom_button= \u00bbon \u00bb button_text_size= \u00bb20px \u00bb button_text_color= \u00bb#000000\u2033 button_bg_color= \u00bbRGBA(255,255,255,0) \u00bb button_border_width= \u00bb0px \u00bb button_border_color= \u00bb#000000\u2033 button_border_radius= \u00bb0px \u00bb button_font= \u00bbPoppins|||||||| \u00bb button_icon= \u00bb\uf1d8||fa||400\u2033 button_icon_color= \u00bb#E02B20\u2033 button_icon_placement= \u00bbleft \u00bb button_on_hover= \u00bboff \u00bb button_custom_margin= \u00bb||0px|0px|false|false \u00bb button_custom_padding= \u00bb0px|0px||0px|false|false \u00bb text_orientation= \u00bbleft \u00bb custom_padding= \u00bb3.7vw|2.9vw|3.7vw|2.9vw \u00bb custom_css_main_element= \u00bbbox-shadow: 0px 4px 47px 0px rgba(160, 190, 212, 0.22);||border-radius: 10px; \u00bb custom_css_contact_button= \u00bb width: 100%;|| margin: 0;|| padding: 12px 0 !important; \u00bb custom_css_contact_fields= \u00bbborder-bottom: 3px solid #dbdbdb !important;|| padding: 20px 0 20px 0px!important; \u00bb custom_css_text_field= \u00bb height: 242px !important;|| resize: none !important;||border-bottom: 3px solid #dbdbdb !important;|| padding: 20px 0 20px 0px!important;||overflow: hidden;|| display:block;|| margin-bottom: 14px; \u00bb border_radii= \u00bbon|0px|0px|0px|0px \u00bb input_border_radius= \u00bb0px \u00bb form_background_color= \u00bb#ffffff \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_contact_field field_id= \u00bbName \u00bb field_title= \u00bbYour name \u00bb fullwidth_field= \u00bbon \u00bb _builder_version= \u00bb4.16\u2033 form_field_font= \u00bb|||| \u00bb form_field_font_size_tablet= \u00bb \u00bb form_field_font_size_phone= \u00bb \u00bb form_field_font_size_last_edited= \u00bbon|desktop \u00bb use_border_color= \u00bboff \u00bb global_colors_info= \u00bb{} \u00bb button_text_size__hover_enabled= \u00bboff \u00bb button_one_text_size__hover_enabled= \u00bboff \u00bb button_two_text_size__hover_enabled= \u00bboff \u00bb button_text_color__hover_enabled= \u00bboff \u00bb button_one_text_color__hover_enabled= \u00bboff \u00bb button_two_text_color__hover_enabled= \u00bboff \u00bb button_border_width__hover_enabled= \u00bboff \u00bb button_one_border_width__hover_enabled= \u00bboff \u00bb button_two_border_width__hover_enabled= \u00bboff \u00bb button_border_color__hover_enabled= \u00bboff \u00bb button_one_border_color__hover_enabled= \u00bboff \u00bb button_two_border_color__hover_enabled= \u00bboff \u00bb button_border_radius__hover_enabled= \u00bboff \u00bb button_one_border_radius__hover_enabled= \u00bboff \u00bb button_two_border_radius__hover_enabled= \u00bboff \u00bb button_letter_spacing__hover_enabled= \u00bboff \u00bb button_one_letter_spacing__hover_enabled= \u00bboff \u00bb button_two_letter_spacing__hover_enabled= \u00bboff \u00bb button_bg_color__hover_enabled= \u00bboff \u00bb button_one_bg_color__hover_enabled= \u00bboff \u00bb button_two_bg_color__hover_enabled= \u00bboff \u00bb][\/et_pb_contact_field][et_pb_contact_field field_id= \u00bbFirst name \u00bb field_title= \u00bbYour first name \u00bb fullwidth_field= \u00bbon \u00bb _builder_version= \u00bb4.16\u2033 form_field_font= \u00bb|||| \u00bb use_border_color= \u00bboff \u00bb global_colors_info= \u00bb{} \u00bb button_text_size__hover_enabled= \u00bboff \u00bb button_one_text_size__hover_enabled= \u00bboff \u00bb button_two_text_size__hover_enabled= \u00bboff \u00bb button_text_color__hover_enabled= \u00bboff \u00bb button_one_text_color__hover_enabled= \u00bboff \u00bb button_two_text_color__hover_enabled= \u00bboff \u00bb button_border_width__hover_enabled= \u00bboff \u00bb button_one_border_width__hover_enabled= \u00bboff \u00bb button_two_border_width__hover_enabled= \u00bboff \u00bb button_border_color__hover_enabled= \u00bboff \u00bb button_one_border_color__hover_enabled= \u00bboff \u00bb button_two_border_color__hover_enabled= \u00bboff \u00bb button_border_radius__hover_enabled= \u00bboff \u00bb button_one_border_radius__hover_enabled= \u00bboff \u00bb button_two_border_radius__hover_enabled= \u00bboff \u00bb button_letter_spacing__hover_enabled= \u00bboff \u00bb button_one_letter_spacing__hover_enabled= \u00bboff \u00bb button_two_letter_spacing__hover_enabled= \u00bboff \u00bb button_bg_color__hover_enabled= \u00bboff \u00bb button_one_bg_color__hover_enabled= \u00bboff \u00bb button_two_bg_color__hover_enabled= \u00bboff \u00bb][\/et_pb_contact_field][et_pb_contact_field field_id= \u00bbYour_email \u00bb field_title= \u00bbYour email \u00bb field_type= \u00bbemail \u00bb fullwidth_field= \u00bbon \u00bb _builder_version= \u00bb4.16\u2033 form_field_font=&quot;||||&quot; \u00bb use_border_color= \u00bboff \u00bb global_colors_info= \u00bb{} \u00bb button_text_size__hover_enabled= \u00bboff \u00bb button_one_text_size__hover_enabled= \u00bboff \u00bb button_two_text_size__hover_enabled= \u00bboff \u00bb button_text_color__hover_enabled= \u00bboff \u00bb button_one_text_color__hover_enabled= \u00bboff \u00bb button_two_text_color__hover_enabled= \u00bboff \u00bb button_border_width__hover_enabled= \u00bboff \u00bb button_one_border_width__hover_enabled= \u00bboff \u00bb button_two_border_width__hover_enabled= \u00bboff \u00bb button_border_color__hover_enabled= \u00bboff \u00bb button_one_border_color__hover_enabled= \u00bboff \u00bb button_two_border_color__hover_enabled= \u00bboff \u00bb button_border_radius__hover_enabled= \u00bboff \u00bb button_one_border_radius__hover_enabled= \u00bboff \u00bb button_two_border_radius__hover_enabled= \u00bboff \u00bb button_letter_spacing__hover_enabled= \u00bboff \u00bb button_one_letter_spacing__hover_enabled= \u00bboff \u00bb button_two_letter_spacing__hover_enabled= \u00bboff \u00bb button_bg_color__hover_enabled= \u00bboff \u00bb button_one_bg_color__hover_enabled= \u00bboff \u00bb button_two_bg_color__hover_enabled= \u00bboff \u00bb][\/et_pb_contact_field][et_pb_contact_field field_id= \u00bbTell us_your_needs \u00bb field_title= \u00bbTell us your needs \u00bb field_type= \u00bbtext \u00bb fullwidth_field= \u00bbon \u00bb _builder_version= \u00bb4.16\u2033 form_field_font= \u00bb|||| \u00bb use_border_color= \u00bboff \u00bb global_colors_info= \u00bb{} \u00bb button_text_size__hover_enabled= \u00bboff \u00bb button_one_text_size__hover_enabled= \u00bboff \u00bb button_two_text_size__hover_enabled= \u00bboff \u00bb button_text_color__hover_enabled= \u00bboff \u00bb button_one_text_color__hover_enabled= \u00bboff \u00bb button_two_text_color__hover_enabled= \u00bboff \u00bb button_border_width__hover_enabled= \u00bboff \u00bb button_one_border_width__hover_enabled= \u00bboff \u00bb button_two_border_width__hover_enabled= \u00bboff \u00bb button_border_color__hover_enabled= \u00bboff \u00bb button_one_border_color__hover_enabled= \u00bboff \u00bb button_two_border_color__hover_enabled= \u00bboff \u00bb button_border_radius__hover_enabled= \u00bboff \u00bb button_one_border_radius__hover_enabled= \u00bboff \u00bb button_two_border_radius__hover_enabled= \u00bboff \u00bb button_letter_spacing__hover_enabled= \u00bboff \u00bb button_one_letter_spacing__hover_enabled= \u00bboff \u00bb button_two_letter_spacing__hover_enabled= \u00bboff \u00bb button_bg_color__hover_enabled= \u00bboff \u00bb button_one_bg_color__hover_enabled= \u00bboff \u00bb button_two_bg_color__hover_enabled= \u00bboff \u00bb][\/et_pb_contact_field][et_pb_contact_field field_id= \u00bbsource \u00bb field_title= \u00bbHow did you find out about Intrinsec? \u00bb fullwidth_field= \u00bbon \u00bb _builder_version= \u00bb4.16\u2033 global_colors_info= \u00bb{} \u00bb][\/et_pb_contact_field][\/et_pb_contact_form][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>","protected":false},"excerpt":{"rendered":"<p>[et_pb_section fb_built= \u00bb1\u2033 _builder_version= \u00bb4.16\u2033 global_colors_info= \u00bb{} \u00bb][et_pb_row column_structure= \u00bb1_2,1_2\u2033 _builder_version= \u00bb4.16\u2033 _module_preset= \u00bbdefault \u00bb custom_margin= \u00bb|6px||6px|| \u00bb custom_padding= \u00bb17px|0px|||| \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_column type= \u00bb1_2\u2033 _builder_version= \u00bb4.16\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_text _builder_version= \u00bb4.23.1\u2033 [\u2026]<\/p>","protected":false},"author":29,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,11],"tags":[62,160],"class_list":["post-227679","post","type-post","status-publish","format-standard","hentry","category-cyber-threat-intelligence","category-threat-intelligence-report","tag-cyber-threat-intelligence-en","tag-cyber-threat-intelligence"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>ThreeAM ransomware - INTRINSEC<\/title>\n<meta name=\"description\" content=\"Intrinsec report on ThreeAM ransomware: Highlights extortion tactics, Russian cybercrime links, and advanced social media use. read more...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/threeam-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ThreeAM ransomware\" \/>\n<meta property=\"og:description\" content=\"Intrinsec report on ThreeAM ransomware: Highlights extortion tactics, Russian cybercrime links, and advanced social media use. read more...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/threeam-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-19T15:40:00+00:00\" \/>\n<meta name=\"author\" content=\"Equipe CTI\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Equipe CTI\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/\"},\"author\":{\"name\":\"Equipe CTI\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8a19ea39207ca7bd0c356c66628c86bb\"},\"headline\":\"ThreeAM ransomware\",\"datePublished\":\"2024-01-19T15:40:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/\"},\"wordCount\":2505,\"keywords\":[\"Cyber Threat Intelligence\",\"Cyber Threat Intelligence\"],\"articleSection\":[\"Cyber Threat Intelligence\",\"Threat Intelligence Report\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/\",\"name\":\"ThreeAM ransomware - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"datePublished\":\"2024-01-19T15:40:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8a19ea39207ca7bd0c356c66628c86bb\"},\"description\":\"Intrinsec report on ThreeAM ransomware: Highlights extortion tactics, Russian cybercrime links, and advanced social media use. read more...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/threeam-ransomware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ThreeAM ransomware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8a19ea39207ca7bd0c356c66628c86bb\",\"name\":\"Equipe CTI\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Equipe CTI\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/equipe-cti\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"ThreeAM ransomware \u2013 INTRINSEC","description":"Intrinsec report on ThreeAM ransomware: Highlights extortion tactics, Russian cybercrime links, and advanced social media use. read more...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/threeam-ransomware\/","og_locale":"en_US","og_type":"article","og_title":"ThreeAM ransomware","og_description":"Intrinsec report on ThreeAM ransomware: Highlights extortion tactics, Russian cybercrime links, and advanced social media use. read more...","og_url":"https:\/\/www.intrinsec.com\/en\/threeam-ransomware\/","og_site_name":"INTRINSEC","article_published_time":"2024-01-19T15:40:00+00:00","author":"Equipe CTI","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Equipe CTI","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/threeam-ransomware\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/threeam-ransomware\/"},"author":{"name":"Equipe CTI","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8a19ea39207ca7bd0c356c66628c86bb"},"headline":"ThreeAM ransomware","datePublished":"2024-01-19T15:40:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/threeam-ransomware\/"},"wordCount":2505,"keywords":["Cyber Threat Intelligence","Cyber Threat Intelligence"],"articleSection":["Cyber Threat Intelligence","Threat Intelligence Report"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/threeam-ransomware\/","url":"https:\/\/www.intrinsec.com\/threeam-ransomware\/","name":"ThreeAM ransomware \u2013 INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"datePublished":"2024-01-19T15:40:00+00:00","author":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8a19ea39207ca7bd0c356c66628c86bb"},"description":"Intrinsec report on ThreeAM ransomware: Highlights extortion tactics, Russian cybercrime links, and advanced social media use. read more...","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/threeam-ransomware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/threeam-ransomware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/threeam-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"ThreeAM ransomware"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8a19ea39207ca7bd0c356c66628c86bb","name":"CTI Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Equipe CTI"},"url":"https:\/\/www.intrinsec.com\/en\/author\/equipe-cti\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/227679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=227679"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/227679\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=227679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=227679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=227679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}