Ransomware Rumble: How 3AM Hackers Use Comedy of Errors for Data Heists
A 3AM ransomware affiliate has adopted the Black Basta playbook, targeting employees with email bombing and spoofed IT support calls. Sophos reports 55 such attacks, but the real kicker? They convinced a target to grant access by impersonating their IT department. Who knew phishing could be so ‘phish’-tastic?
Hot Take:
It looks like the 3AM ransomware crew is pulling out all the stops, going full Mission Impossible by combining email bombings with phone phishing. Who knew cybercriminals could be such multitaskers? It’s like they’re trying to win an Oscar for Best Phishing Performance! But seriously, these tactics are as sophisticated as they are sneaky, proving once again that cybercrime doesn’t sleep, even at 3 AM.
Key Points:
- 3AM ransomware affiliates use email bombing and spoofed IT support calls to socially engineer employees.
- The tactic was previously linked to Black Basta and FIN7 ransomware groups.
- Sophos reports 55 attacks between November 2024 and January 2025.
- Attackers use Microsoft Quick Assist and spoofed phone numbers to gain network access.
- Data exfiltration and persistent access via QEMU and GoodSync tools were reported.
Already a member? Log in here