Researchers have observed a new ransomware family deployment in conjunction with LockBit ransomware. The deployment of the new ransomware strain “3AM” was proceeded by a command to dump the target system’s policy settings for a specific user, which then allowed the threat actors to install certain Cobalt Strike components and continue to escalate privileges using PsExec. If the threat actor failed to install LockBit on a targeted network after escalating privileges, 3AM was pushed for installation instead. 3AM first attempts to halt security and backup tools, before deleting volume shadow copies in an attempt to stop file recovery from occurring post compromise. 3AM then follows the typical pattern of encrypting files, leaving them with the “.threeamtime” extension while also leaving a text file ransom note named “RECOVER-FILES.txt”. Additionally, each encrypted file is exfiltrated to an FTP server. Although 3AM was only deployed after LockBit’s installation was unsuccessful, it does not appear to have been very effective and was actively blocked on more than 60% of the observed systems. Despite its current effectiveness, the use of 3AM represents a change in tactics by LockBit affiliates that is worth monitoring. CTIX analysts will continue to track the use of ransomware strains and affiliate use and will report back with available updates.