Introduction: Three Years Later
In September 2023, I published 3 AM Ransomware Dissection on TheCyberThrone.in, examining a relatively new ransomware family that had attracted attention because of its association with LockBit.
At the time, 3AM stood out for its Rust-based encryptor and its reported use as an alternative payload when a LockBit deployment failed.
Three years later, the story has evolved.
The interesting development is no longer just about ransomware encryption. It is about how attackers gain access, manipulate employees, compromise identities, move across enterprise environments and steal information before deploying ransomware.
Recent investigations have also introduced another dimension: suspected AI-assisted intrusion activity.
Let’s examine what has changed.
1. Revisiting the 2023 foundation
When 3AM emerged in September 2023, researchers identified several characteristics:
- Rust-based ransomware development.
- File encryption and ransom-note deployment.
- Anti-analysis and anti-debugging capabilities.
- Attempts to terminate security-related processes.
- Interference with recovery mechanisms.
- Double-extortion tactics involving data theft and encryption.
Its association with the wider Conti, Royal and BlackSuit ecosystem made its operational background particularly interesting.
However, subsequent investigations demonstrated that the threat extended beyond its original ransomware payload.
2. 2025: Social engineering became the entry point
One of the most significant developments emerged in Sophos’ investigation of a 3AM-affiliated attack during Q1 2025.
The attackers combined email bombing with voice phishing.
The sequence was straightforward but effective:
- The targeted employee received a flood of unsolicited emails.
- An attacker called, impersonating the organisation’s IT support team.
- The attacker used the email disruption as justification for offering assistance.
- The employee was persuaded to grant remote access through Microsoft Quick Assist.
In the documented incident, 24 unsolicited emails arrived within approximately three minutes.
This was more than conventional phishing. It was a coordinated social engineering operation designed to make the victim voluntarily facilitate access.
The tactical shift: Employees became the entry point into the corporate network through manipulated trust.
3. QEMU, QDoor and legitimate administration tools
After obtaining remote access, attackers deployed a QEMU virtual machine containing a Windows 7 environment with a pre-installed QDoor backdoor.
This approach provided an alternative execution environment and helped the attackers operate beyond conventional endpoint monitoring.
The investigation also identified the use of legitimate administrative utilities and remote access mechanisms, including:
- PowerShell.
- Windows Management Instrumentation (WMI).
- Remote Desktop Protocol (RDP).
- Commercial remote management tools.
These techniques illustrate the growing importance of Living off the Land (LOTL) activity.
The challenge for defenders is no longer simply identifying malicious executables. It is determining whether legitimate administrative tools are being used for unauthorised purposes.
4. Data theft before encryption
The 2025 investigation revealed another important development.
Attackers remained inside the victim’s network for nine days before attempting ransomware deployment.
During that period, they exfiltrated approximately 868 GB of data, using GoodSync to transfer information to Backblaze cloud storage.
The ransomware deployment was largely prevented by security controls. However, the data theft had already occurred.
This changes the incident-response equation.
Restoring servers does not reverse data exposure. Recovering from backups does not eliminate the consequences of stolen information.
Ransomware defence must therefore address confidentiality, integrity and availability independently.
5. November 2026: Suspected AI-assisted operations
A particularly interesting development appeared in Bitdefender’s investigation published on November 3, 2026.
The investigation examined a 3AM-affiliated intrusion against a UK school estate.
Researchers documented credential theft from backup infrastructure, rogue domain administrator accounts, Active Directory trust manipulation and lateral movement across multiple domains.
Some of the technical details were particularly concerning:
- Credentials were extracted from Veeam backup databases.
- Browser credentials were collected from a terminal server.
- Rogue domain administrator accounts were created.
- Two-way Active Directory trusts were established across three domains.
- Approximately 37 machines were encrypted.
However, the most interesting observation concerned command execution.
Bitdefender identified repeated command attempts, revisions and troubleshooting sequences that suggested possible AI-assisted command generation.
The suspected operating model involved a human operator defining the objective while an AI-assisted process helped construct and revise commands based on execution results.
It is important to distinguish observation from attribution. The investigation did not conclusively establish that an autonomous AI agent conducted the attack.
Nevertheless, it introduces an important question: could AI-assisted troubleshooting reduce the operational effort required to conduct complex intrusions?
6. What changed between 2023 and 2026?
The evolution becomes clearer when we compare the operational characteristics.
Initial access
- 2023: Association with existing ransomware intrusions.
- 2025: Email bombing, vishing and Quick Assist abuse.
- 2026: Initial access in the investigated incident remains unknown.
Execution and persistence
- 2023: Rust-based ransomware and conventional post-compromise activity.
- 2025: QEMU virtualisation, QDoor and legitimate remote administration.
- 2026: Rogue domain accounts and cross-domain trust manipulation.
Credential compromise
- 2023: Conventional credential and privilege compromise.
- 2025: Compromised accounts and expanded network access.
- 2026: Backup database and browser credential theft.
Data exfiltration
- 2023: Double-extortion model.
- 2025: Approximately 868 GB stolen before encryption.
- 2026: Finance data staging and transfer during the intrusion.
Defence evasion
- 2023: Anti-analysis and security-process interference.
- 2025: Virtualisation and legitimate administration tools.
- 2026: Security-control interference and suspected AI-assisted troubleshooting.
The important shift is from focusing on the ransomware payload to understanding the entire intrusion lifecycle.
7. What should security teams change?
The evolution of 3AM offers several practical defensive lessons.
Identity security: Monitor privileged account creation, unusual authentication, service-account activity and unexpected Active Directory trust changes.
Backup protection: Isolate backup infrastructure, restrict administrative access and protect stored credentials. Backup servers must not become an alternative route into production.
Remote access governance: Restrict and monitor Quick Assist, commercial RMM tools and unexpected remote administration sessions.
Endpoint visibility: Investigate unusual QEMU execution, suspicious PowerShell activity, WMI usage and abnormal administrative tool combinations.
Data exfiltration monitoring: Detect bulk file staging, unusual cloud synchronisation and abnormal outbound transfers independently of ransomware alerts.
AI-aware detection: Focus on observable behaviours such as repeated command revisions, unusual execution sequences and suspicious troubleshooting activity rather than attempting to determine whether a command was written by AI.
Conclusion: Dissect the entire operation
When I first dissected 3AM in September 2023, the focus was on understanding a new ransomware family and its association with the wider ransomware ecosystem.
In November 2026, the discussion is much broader.
The latest investigations demonstrate how 3AM-affiliated operations have combined social engineering, credential theft, legitimate administration tools, infrastructure compromise and suspected AI-assisted execution.
The encryptor remains important, but the intrusion that precedes it is becoming increasingly consequential.
Do not wait for the ransomware binary to execute before declaring an intrusion. By that stage, the attackers may already have compromised identities, stolen sensitive information and established control over critical infrastructure.
Three years ago, we dissected the ransomware. Today, we need to dissect the entire operation behind it.
