- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Sources
- 1 source carries it
- Identifier
- GINC-APT-1220 · termite-ransomware-operators
What it is
The Termite ransomware strain has been observed since April 2024. Researchers have noted considerable code and behavioral overlaps between the Babuk ransomware and Termite.<sup>[Infosecurity Magazine December 9 2024]</sup> Actors using Termite have attacked organizations in various sectors and locations, publicly extorting some victims on a dark web "data leak" site since November 2024.<sup>[GitHub ransomwatch]</sup> News reports linked a series of attacks in late 2024, which exploited vulnerabilities in Cleo managed file transfer ("MFT") software, to Termite ransomware operators.<sup>[DarkReading Termite Cleo December 10 2024]</sup>
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Dark DDoSeR
- DarkRat
- Xploit