threat actor · Origin not attributed
3AM
On record in CyberSIXT
Sources name this actor but link nothing to it yet: no CVE, technique or software is on record.
Open 3AM's actor page3AM is a ransomware group named in two CyberSIXT article summaries. Bitdefender reported that a 3AM affiliate attacked a UK school, stealing data and deploying ransomware, and described the operation as involving both a human operator and AI. Little is on record: CyberSIXT has no recorded attribution or CVEs for 3AM.
Source: CyberSIXT summary, 14 November 2026. Written by CyberSIXT's model from CyberSIXT's own article summaries and records, and checked against them; read the articles before relying on it.
- Origin
- Not attributed
- On record in
- CyberSIXT
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.