SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

3am

11 Einträge insgesamt

Zeitraum: 18.08.2026 – 06.10.2026

3AM, also known as ThreeAM, is a relatively new ransomware family that emerged in late 2023, initially deployed as a fallback option when LockBit infections failed. Written in Rust for 64-bit systems, it appends the “.threeamtime” extension to encrypted files and tags them with the marker “0x666,” while deleting Volume Shadow Copies to hinder recovery. 3AM operators use a double extortion strategy, combining file encryption with data theft and threats to leak stolen information. More recent campaigns have shown increased sophistication, incorporating email bombing followed by vishing calls to convince victims to grant remote access via Microsoft Quick Assist. Attackers then deploy virtual machines containing backdoors, allowing them to remain undetected while exfiltrating data before attempting to launch the ransomware payload.

Veröffentlichungskanäle

  • Leak-Seite · zuletzt nicht erreichbar
  • Dateiablage · 403 Forbidden · zuletzt nicht erreichbar
  • Chat · Enter the key · zuletzt erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Keine Meldung im Bestand nennt diese Gruppe — sie arbeitet unbeachtet. Das ist der Regelfall: von 81 aktiven Gruppen haben 23 ein Medienecho.

Neueste Einträge

Filter zurücksetzen
3amfleetworksinc.comUS

Beschreibung der Täter

Fleetworks Inc. offers comprehensive heavy-duty truck repair and fleet services across California, with locations in Oakland, Santa Fe Springs, and Riverside. Their skilled team specializes in a wide range of services including diesel repair, flee | PUBLISHED 0% | Views: 25

Herkunft

3amsafescaffolding.net—

Beschreibung der Täter

Safe Scaffolding is a privately held contractor operating primarily in the commercial and residential construction industry. The company provides physical scaffolding infrastructure, materials, and equipment setup to support building and renovatio | PUBLISHED 0% | Views: 23

Herkunft

3amcoosalud.comCO

Beschreibung der Täter

Coosalud EPS (Coosalud Entidad Promotora de Salud S.A.) is one of the major health promotion entities (EPS) in Colombia, primarily managing subsidized and contributory healthcare regimes with multi-million-peso operating volumes. Alongside its sub | PUBLISHED 0% | Views: 22

Herkunft

3ampistonespersan.com.arAR

Beschreibung der Täter

Pistones Persan specializes in high-performance pistons and accessories, offering over 600 products from 53 brands. The company is certified under ISO standards and INMETRO, ensuring original quality. With a presence in more than 31 countries acro | PUBLISHED 0% | Views: 24

Herkunft

3ammidwestbit.comUS

Beschreibung der Täter

Midwest Business Technology specializes in providing customized IT solutions and services to businesses and government agencies across the U.S. Their offerings include managed IT services, software development, cybersecurity solutions, and various | PUBLISHED 0% | Views: 23

Herkunft

3amapexus.com—

Beschreibung der Täter

Apexus, founded in 2007, is a business services company that manages the 340B Prime Vendor Program supporting the 340B Drug Pricing Program. The company negotiates pricing discounts with pharmaceutical manufacturers, provides educational resources | PUBLISHED 0% | Views: 23

Herkunft

3ambhn-expertise.com—

Beschreibung der Täter

BHN Expertise is an accounting firm that helps businesses manage their financial records and grow smartly. With offices across Normandy in cities like Bolbec, Caen, Rouen, and Yvetot, they provide local support and personalized accounting services | PUBLISHED 0% | Views: 23

Herkunft

3amstjames.wa.edu.auAU

Beschreibung der Täter

St James’ Anglican School provides a holistic education for students from Kindergarten to Year 12, focusing on unlocking individual potential and fostering excellence across various disciplines. The school offers a diverse curriculum that includes | PUBLISHED 0% | Views: 28

Herkunft

3amnewmantractor.comUS

Beschreibung der Täter

Since 1976, Newman Tractor has been serving the heavy equipment industry both domestically, and internationally. Originally founded as a farm equipment business in Boone County, Kentucky, Newman Tractor has transformed into one of this country's m | PUBLISHED 100% | Views: 106

Herkunft

3amwmdn.net—

Beschreibung der Täter

Twin States News is a media organization that provides comprehensive coverage of local, state, national, and world news. Their services include reporting on various topics such as crime, education, health, politics, and community events. The inten | PUBLISHED 1% | Views: 43

Herkunft

3ammecasem.org—

Beschreibung der Täter

The group gives quality and reliability the highest priority in the through execution of all its business activities. Therefore MECASEM provides a wide range of solutions ISO 17025 (COFRAC) accredited and EN 9100 and ISO 9001 certified. Since 2012 | PUBLISHED 1% | Views: 33

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.