Researchers link 3AM ransomware to Conti, Royal cybercrime gangs

Security researchers link the recently emerged 3AM/ThreeAM ransomware operation to the Conti syndicate and Royal/Blacksuit affiliates based on overlapping infrastructure, TTPs, and reused artifacts; investigators found IOCs including IP 185.202.0.111, PowerShell/Cobalt Strike artifacts, SOCKS4 proxy usage, TLS certificates, and hosting overlaps on UAB Cherry Servers. 3AM has leaked data for at least 19 victims on a Tor site and tested a novel extortion tactic using automated replies on X/Twitter to broadcast breaches and pressure victims.