THREAT ACTOR
3AM_
Dormant3AM is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of 3AM, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 19
- 2025 24
- 2024 35
- 2023 19
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onionVerify snapshot · 2026-09-22 23:35 -
ulkvlj5sirgrbnvb4hvbjo2ex2c2ceqe2j4my57fcdozpbq5h5pyu7id.onion403 Forbidden snapshot · 2025-01-09 21:21 -
threeam7fj33rv5twe5ll7gcrp3kkyyt6ez5stssixnuwh4v3csxdwqd.onionEnter the key snapshot · 2026-09-23 02:19
Recent victims
The 50 most recent victims claimed by 3AM. Total in the index: 97.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-21 | newmantractor.com | Since 1976, Newman Tractor has been serving the heavy equipment indust… |
| 2026-08-29 | wmdn.net | Twin States News is a media organization that provides comprehensive c… |
| 2026-08-18 | mecasem.org | The group gives quality and reliability the highest priority in the th… |
| 2026-08-05 | clubonecasino.com | Club One Casino is the premier poker room in Central California, featu… |
| 2026-07-08 | tws-tac.net | While ownership has changed over the years, the company has remained l… |
| 2026-06-29 | guardianbarrierservices.com | Guardian Barrier Services provides a wide range of products and servic… |
| 2026-06-27 | acemacon.org | The Academy for Classical Education is dedicated to fostering knowledg… |
| 2026-06-12 | jetmachprod.com | Jet Machined Products specializes in high-performance milled and turne… |
| 2026-06-12 | jastrebarsko.hr | Town of Jastrebarsko, a historic city in Central Croatia located betwe… |
| 2026-06-12 | palmero.com | Palmero is a company dedicated to the manufacturing and marketing of c… |
| 2026-06-12 | insamani.com.ar | INSA INDELMA S.A. is a leading agro-industrial company in Argentina sp… |
| 2026-06-12 | bsynchro.com | BSynchro Holding is an insurtech software provider that specializes in… |
| 2026-06-12 | molinoscabodi.com.ar | Molinos Cabodi Hnos. S.A. has been providing high-quality flour produc… |
| 2026-06-12 | ws.com.br | WS Group Brasil is a Brazilian operations and business services provid… |
| 2026-06-12 | consultic.be | ConsulTIC specializes in IT solutions, offering services such as appli… |
| 2026-06-12 | amc.org.au | The Australian Medical Council (AMC) is an independent national standa… |
| 2026-06-12 | agroexportavocados.com | Agro Industrial Exportadora SA de CV (AGRIEXP) is a Mexican holding co… |
| 2026-06-12 | hoplongtech.com | Công ty Cổ phần Công Nghệ Hợp Long is a leading distributor of automat… |
| 2026-06-12 | mgrlaw.com | Mogren, Glessner & Ahrens Law Firm is a full-service law firm located … |
| 2025-11-25 | aceforwarding.com | Ace Forwarding started out in 1994 as a small operation with a single … |
| 2025-11-18 | ic-controls.com | Industrial Controls SAC, desde 1994 ofrece a nivel nacional, desarroll… |
| 2025-10-16 | bun.nl | Bun creëert woon-, werk- en leefruimte voor iedereen en van de beste k… |
| 2025-10-02 | hsjlawyers.com | Founded in 1971, HSJ Lawyers is a prominent law firm located in Prince… |
| 2025-09-04 | townofnorwell.net | The Town of Norwell MA offers a variety of municipal services includin… |
| 2025-09-04 | curedentalbeltontx.com | Cure Dental is a company that operates in the Dental Offices industry.… |
| 2025-09-04 | austinplasticandreconstructivesurgery.com | Austin Plastic Reconstructive Surgery, led by Board-Certified Plastic … |
| 2025-07-19 | sequoiadental.com | Sequoia Dental Office provides a wide range of dental services includi… |
| 2025-06-28 | wyomingcountyny.gov | |
| 2025-05-25 | vazirilaw.com | |
| 2025-04-10 | gosvt.com | |
| 2025-04-10 | neffendorfblockercpa.com | |
| 2025-04-10 | jastreet.com | |
| 2025-04-10 | icmtx.com | |
| 2025-04-10 | dbhcares.com | |
| 2025-04-10 | icgad.com | |
| 2025-04-10 | iss-na.com | |
| 2025-04-10 | kkp.law | |
| 2025-02-13 | leonardo.com | |
| 2025-02-12 | sehma.com | |
| 2025-02-05 | corehandf.com | |
| 2025-01-30 | soitinlaine.fi | |
| 2025-01-15 | anwsd.org | |
| 2025-01-09 | hapsch.de | |
| 2024-12-17 | kuritaamerica.com | |
| 2024-12-04 | hobokennj.gov | |
| 2024-11-13 | midstatesindustrial.com | |
| 2024-10-31 | anuenterprise.com.au | |
| 2024-10-31 | inhometexas.com | |
| 2024-10-31 | caillau.com.br | |
| 2024-10-31 | sandray.com |
CONFIRMED ATTACKS
3am confirmed attacks: 12 verified incidents
Ransomnews has verified 12 3am incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from October 2023 to May 2026. United States accounts for 9 of them (75%), with victims recorded in 4 countries in total. The most affected sector is healthcare, at 5 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 10. Where a figure was disclosed (5 cases), these incidents account for 567,954 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified 3am incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| May 2026 | Grad Jastrebarsko | Government | Jastrebarsko, Croatia | — | Unknown | Source |
| October 2025 | Bun | Other | Almere, Netherlands | — | Unknown | Source |
| June 2025 | Austin Plastic & Reconstructive Surgery | Healthcare | Texas, United States | 4,041 | Unknown | Source |
| January 2025 | Addison Northwest School District | Education | Vermont, United States | — | Unknown | Source |
| November 2024 | Kurita America Inc. | Manufacturing | Minnesota, United States | — | Unknown | Source |
| November 2024 | City of Hoboken | Government | New Jersey, United States | — | Unknown | Source |
| October 2024 | In-Home Attendant Services, Ltd. | Healthcare | Texas, United States | 22,100 | Unknown | Source |
| October 2024 | ANU Enterprise Pty Limited | Education | Canberra, Australia | — | No | Source |
| September 2024 | Carolina Arthritis Associates | Healthcare | North Carolina, United States | 36,961 | No | Source |
| July 2024 | Brunswick Hospital Center | Healthcare | New York, United States | 40,764 | Unknown | Source |
| February 2024 | Kootenai Health | Healthcare | Idaho, United States | 464,088 | Unknown | Source |
| October 2023 | Carrell Blanton Ferris & Associates | Legal | Virginia, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from 3am's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.