3AM Ransomware Recovery: .threeamtime Files, Teams Vishing and What Survives

3AM, also tracked as ThreeAM, was first described by Symantec's Threat Hunter Team in 2023 as a new ransomware family written in Rust. It takes its name from its ransom note, and encrypted files get the extension .threeamtime. ransomware.live counts about 100 victim claims on its leak site, with new victims still being posted in October 2026.

Sophos documented a 2025 intrusion that followed the pattern Microsoft first described for Storm-1811: the victim's mailbox is flooded with spam (email bombing), and then an attacker calls over Microsoft Teams pretending to be the IT help desk, in that case spoofing the phone number of the company's real IT department. The caller talks the employee into opening a remote session with Quick Assist. The attackers then ran a virtual machine on the compromised computer, which gave them a foothold hidden from the endpoint protection software, and stole data before trying to encrypt.

Before encrypting, the 3AM encryptor tries to stop a list of services such as backup and database services, and afterwards deletes the Windows Volume Shadow Copies so the files cannot simply be restored from them.

There is no public decryptor for 3AM. Recovery without the key works from what the encryptor did not overwrite: large files such as SQL Server and Oracle databases, VMware and Hyper-V virtual disks and Veeam backup files often keep most of their content. We measure exactly which regions of each file were encrypted and rebuild tables, virtual machines and files from the intact parts.

Keep the encrypted files and the ransom note, do not wipe or reinstall the servers, and contact us for a free assessment. No data, no charge.