Ransomware Group intelligence
Termite
ActiveTrack Termite with 51 published victims and 1 known leak locations in a single intelligence view.
Overview
Termite is tracked by Breach House as a ransomware group with 51 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | termiteuslbumdge2zmfmfcsrvmvsfe4gvyudc5j6cdnisnhtftvokid.onion |
Top Activity Sectors (14)
- Healthcare / Pharma 10
- Communication / Marketing 8
- Manufacturing / Engineering 7
- Finance / Legal / Insurance 5
- Education 4
- Public Sector 2
- Hospitality / Food & Beverage / Tourism 2
- Not identified 2
- Transportation / Travel / Logistics 2
- Energy 2
- Agriculture / Food 1
- Services 1
- IT 1
- Construction / Real Estate 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Termite, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: termite executes PowerShell scripts to stage payloads and perform initial system modifications on compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: termite leverages native API calls to interact with Windows services and evade detection during lateral movement.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
What they do: termite adds malicious registry run keys to ensure persistence by executing payloads automatically at system startup.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: termite disables antivirus tools and security software by terminating processes and modifying system configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: termite deletes Volume Shadow Copies and backup directories using vssadmin and native file deletion commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: termite performs remote system discovery to identify high-value targets in Communication and Marketing sectors for prioritized encryption.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: termite spreads via SMB/Windows Admin Shares to encrypt files across networked machines within the victim environment.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: termite exfiltrates stolen data via encrypted C2 channels before deploying ransomware, demanding double extortion payments.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: termite encrypts victim files using custom symmetric encryption routines targeting documents, databases, and project folders.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: termite invokes system shutdown commands and service termination scripts to maximize operational disruption during impact phase.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
how to restore your files.txt
Visit http://termiteuslbumdge2zmfmfcsrvmvsfe4gvyudc5j6cdnisnhtftvokid.onion for addictional information. Support token: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (51)
Search, filter and paginate the victim timeline for Termite. Showing 1–51 of 51.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Everglades Boats id31957 View details | United States | — | ||
|
Founded in 2001, Everglades Boats is a manufacturer of offshore fishing boats. The company is headquartered in Edgewater, Florida. |
|||||
| Ransomware | Affinia Healthcare id31004 View details | United States | Healthcare / Pharma | ||
|
Affinia Healthcare is a healthcare organization based in the United States, providing medical services to patients. The organization operates within the healthcare sector, offering various medical services. Affinia Healthcare was listed as a ransomware victim associated with termite. |
|||||
| Ransomware | Affinia Healthcare id31004 View details | United States | Healthcare / Pharma | ||
|
Affinia Healthcare is dedicated to providing high-quality medical care and exceptional services across multiple locations in the St. Louis area. They offer a comprehensive range of health services including primary care, dental, behavioral health, and specialized programs for all family members, particularly focusing on underprivileged communities. |
|||||
| Ransomware | JD Young id30999 View details | China | Finance / Legal / Insurance | ||
|
JD Young is a financial services company based in China, operating in the finance, legal, and insurance sectors. The company provides various financial services to its clients. JD Young was listed as a ransomware victim associated with termite |
|||||
| Ransomware | JD Young id30999 View details | China | Finance / Legal / Insurance | ||
|
JD Young helps financial institutions simplify workflow processes, automate the flow of information, adhere to compliance and determine suitable document hardware for multiple locations. The company's document solutions include electronic document management, lock box, hardware fleet management, SaaS (software as a service), multi-function hardware, printing services and more. |
|||||
| Ransomware | Cal Fresh id29714 View details | Canada | Public Sector | ||
|
The California Association of Food Banks (CAFB) is committed to ending hunger in California and aims to provide clear, up-to-date information about CalFresh for people who are interested in applying. Since 2003, CAFB has partnered with food banks and other community-based organizations throughout the state to educate consumers about CalFresh and provide application assistance. |
|||||
| Ransomware | Wiese USA id29695 View details | United States | Manufacturing / Engineering | ||
|
Wiese Inc is a material handling machinery company. It offers forklifts, railcar movers, yard trucks, dock equipments, and other machinery. The company was established in 1944 and is based in St. Louis, Missouri. |
|||||
| Ransomware | Roland Machinery id29696 View details | Australia | Manufacturing / Engineering | ||
|
Founded in 1958 and headquartered in Springfield, Illinois, Roland Machinery Co. provides wholesale distribution of construction equipment. The Company offers forestry, aggregate, and paving equipment, as well as rents construction, road maintenance, and crushing equipment. |
|||||
| Ransomware | Indiana Mills and Manufacturing id29377 View details | United States | Manufacturing / Engineering | ||
|
You have 24 hours to contact us. |
|||||
| Ransomware | UEI College id29378 View details | United States | Education | ||
|
UEI College is a private for-profit career college with locations in the US states of California, Washington, Arizona, Nevada, Texas, New Mexico, and Georgia. It specializes in short-term technical and vocational education to prepare students for entry-level positions in industries such as healthcare, business, and skilled trades. |
|||||
| Ransomware | RAMAR FOODS INTERNATIONAL id29190 View details | United States | Agriculture / Food | ||
|
Ramar Foods is a leading manufacturer and distributor of Filipino frozen food products, established in 1969. The company is committed to bringing the flavors of the Philippines to consumers through its portfolio of brands, which include iconic offerings like Magnolia, Orientex, Manila Gold, and Frescano. |
|||||
| Ransomware | Millennium Dental Technologies id28276 View details | United States | Healthcare / Pharma | ||
|
Founded in 1994 and Headquartered in Cerritos, California. Millennium Dental Technologies, Inc manufactures and distributes dental products. It offers PerioLase MVP-7, a laser designed especially for laser periodontal therapy that performs soft and hard tissue laser procedures. |
|||||
| Ransomware | Noll and Tam Architects id27375 View details | United States | Healthcare / Pharma | ||
|
Noll & Tam Architects specializes in creating innovative architectural designs that serve the common good. Their projects range from community centers and libraries to veterinary hospitals and educational facilities, emphasizing sustainability and empathy in their approach. |
|||||
| Ransomware | City of Huntington id27154 View details | United States | Public Sector | ||
|
Founded in 1871, the City of Huntington is located in western West Virginia. It is the county seat of Cabell County and also stretches into Wayne County. |
|||||
| Ransomware | Bartram Trail Surveying id26994 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
Bartram Trail Surveying, Inc. is a Florida licensed land surveying company that specializes in providing accurate and precise land surveying services across the state. Utilizing state-of-the-art technology, including drone surveying, LiDAR, and GIS, they cater to builders, engineers, and clients involved in land development projects. |
|||||
| Ransomware | Insight Hospital and Medical Center Chicago id26915 View details | United States | Healthcare / Pharma | ||
|
Founded in 1852 Mercy Hospital and Medical Center is a member of Trinity Health. They are a teaching hospital headquartered out of Chicago, Illinois. |
|||||
| Ransomware | Jones Haber id26849 View details | United States | Finance / Legal / Insurance | ||
|
Jones, Haber & Rollings is a multi-service law firm based in Cape Coral, Florida, with over 75 years of combined legal expertise. Established in 1988, the firm provides comprehensive legal counsel across various practice areas throughout the state of Florida. |
|||||
| Ransomware | The Siskiyou Telephone id26848 View details | United States | Services | ||
|
Siskiyou Telephone is a rural independent service provider serving Western Siskiyou County, California, since 1896. The company offers high-speed internet packages with speeds up to 1000 Mbps and telephone services, catering to both residential and business clients. |
|||||
| Ransomware | Birmingham Museum of Art id26835 View details | United States | Education | ||
|
The Birmingham Museum of Art in Alabama features a vast collection of over 27,000 artworks and offers free admission to visitors. The museum is open from Tuesday to Sunday and hosts various exhibitions and events throughout the year. It serves a diverse audience, including families, students, and art enthusiasts, providing educational resources and opportunities for engagement. |
|||||
| Ransomware | Insight Hospital & Medical Center Chicago id26831 View details | United States | Healthcare / Pharma | ||
|
Founded in 1852 Mercy Hospital & Medical Center is a member of Trinity Health. They are a teaching hospital headquartered out of Chicago, Illinois |
|||||
| Ransomware | Family Health Center id26082 View details | United States | Healthcare / Pharma | ||
|
Family Health Centers of Southern Indiana offers quality healthcare services to low-income, underinsured, and uninsured residents in Jeffersonville, New Albany, Corydon, and Clarksville. Their dedicated team of board-certified physicians and nurse practitioners provides a wide range of primary health care services, including a mobile dental unit. The organization emphasizes care for |
|||||
| Ransomware | Hermes Medical Solutions id25084 View details | Sweden | Healthcare / Pharma | ||
|
Hermes Medical Solutions is a leader in molecular imaging software, offering an innovative suite designed for faster and more personalized diagnostics and therapies in the fields of nuclear medicine and molecular imaging. Their all-in-one software, Hermia, integrates various medical imaging modalities and advanced dosimetry tools, making it suitable for diverse clinical specialties. |
|||||
| Ransomware | MedHelp id24874 View details | United States | Healthcare / Pharma | ||
|
MedHelp Birmingham provides urgent and primary care services in the Birmingham area, welcoming walk-in patients. Their offerings include a Long COVID clinic, wellness therapies, and specialized services such as Lyme Disease treatment and gynecology care. |
|||||
| Ransomware | News-Press and Gazette Co. id22657 View details | United States | Communication / Marketing | ||
|
News-Press & Gazette Company publishes daily newspapers and weekly publications. It provides cable, internet, and digital telephone services, as well as commercial printing services, such as Web and sheet-fed services. In addition, it operates television and radio stations. It was established in 1845 and is headquartered in St. Joseph, Missouri. |
|||||
| Ransomware | News-Press & Gazette Co. id22596 View details | United States | Communication / Marketing | ||
|
News-Press & Gazette Company publishes daily newspapers and weekly publications. It provides cable, internet, and digital telephone services, as well as commercial printing services, such as Web and sheet-fed services. In addition, it operates television and radio stations. It was established in 1845 and is headquartered in St. Joseph, Missouri. |
|||||
| Ransomware | News-Press & Gazette Co. id22595 View details | United States | Communication / Marketing | ||
|
News-Press & Gazette Company publishes daily newspapers and weekly publications. It provides cable, internet, and digital telephone services, as well as commercial printing services, such as Web and sheet-fed services. In addition, it operates television and radio stations. It was established in 1845 and is headquartered in St. Joseph, Missouri. |
|||||
| Ransomware | News-Press & Gazette Co. id22594 View details | United States | Communication / Marketing | ||
|
News-Press & Gazette Company publishes daily newspapers and weekly publications. It provides cable, internet, and digital telephone services, as well as commercial printing services, such as Web and sheet-fed services. In addition, it operates television and radio stations. It was established in 1845 and is headquartered in St. Joseph, Missouri. |
|||||
| Ransomware | News-Press & Gazette Co. id22417 View details | United States | Communication / Marketing | ||
|
News-Press & Gazette Company publishes daily newspapers and weekly publications. |
|||||
| Ransomware | LGM id19765 View details | France | Manufacturing / Engineering | ||
|
LGM, filiale du Groupe LGM, accompagne ses clients dans lamélioration de la performance en conception, production, exploitation et maintenance. |
|||||
| Ransomware | Ushio id19637 View details | Japan | Other | ||
|
Ushio is a world market leader for speciality lighting, from ultraviolet to infrared and everything in between. |
|||||
| Ransomware | Bjørklund id19101 View details | Norway | Manufacturing / Engineering | ||
|
Bjorklund Norge AS was founded in 1992. The Company's line of business includes the wholesale distribution of jewelry, precious stones and metals, costume jewelry, watches, clocks, and silverware. |
|||||
| Ransomware | On IT id19095 View details | Belgium | IT | ||
|
Provider of information technology services focused on digital transformation for enterprises. The company specializes in offering small and medium enterprises managed services, data analysis with Power BI, digital project management, technical training and IT support services, thereby enabling companies to modernize and uncomplicate their processes and offer technological support. |
|||||
| Ransomware | Perrigo Company id18425 View details | Ireland | Healthcare / Pharma | ||
|
Perrigo, founded in 1887 and headquartered in Dublin, Ireland, is a global healthcare supplier and manufacturer of private label over-the-counter pharmaceuticals. |
|||||
| Ransomware | London Belgravia id17812 View details | United Kingdom | Finance / Legal / Insurance | ||
|
London Belgravia Brokers provide risk insurance and finance advisory solutions to global property developers, investors and high net worth individuals. |
|||||
| Ransomware | National Legal Service id17811 View details | United Kingdom | Finance / Legal / Insurance | ||
|
National Legal Service are a leading Criminal, Family and Child Care firm conducting both private and legal aid work to a diverse client base. |
|||||
| Ransomware | Rooks Rider Solicitors id17810 View details | United Kingdom | Finance / Legal / Insurance | ||
|
Founded in 1761, Rooks Rider Solicitors is a boutique law firm specializing in corporate law, real estate, and wealth planning, with a strong international reach. The firm focuses on providing personalized legal services, ensuring that their clients receive tailored solutions for their individual needs. Their expertise extends across various areas including dispute resolution, employ |
|||||
| Ransomware | Arcandco id17809 View details | Canada | Construction / Real Estate | ||
|
Arc & Co. was formed in 2007, concentrates on financing Property, Marine and Aviation assets. |
|||||
| Ransomware | Genea id17808 View details | Australia | Communication / Marketing | ||
|
Founded in 1984, Genea is a reproductive and fertility treatment and care facility. The company is headquartered in Sydney, New South Wales |
|||||
| Ransomware | Ligentia id17653 View details | United Kingdom | Transportation / Travel / Logistics | ||
|
Ligentia provides freight forwarding and supply chain management solutions. The company was founded in 1996 and is headquartered in Leeds, United Kingdom |
|||||
| Ransomware | CESI id17443 View details | France | Education | ||
|
CESI is a private French higher education and vocational training group specialising in training engineers, managers, technicians and supervisors. |
|||||
| Ransomware | Zschimmer and Schwarz id17005 View details | Germany | Manufacturing / Engineering | ||
|
Zschimmer and Schwarz, a family owned business founded in 1894, with headquarters in Lahnstein, Germany, develops and produces high performance chemical auxiliaries for the leather, ceramic, textile or fiber, personal care, lubricant, polymer, and phosphonate industries or markets. |
|||||
| Ransomware | Huntington Hotel Group id16549 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
Huntington Hotel Group was founded in 1998 by Kevin Keefer and Brent Andrus with the vision of developing and managing premium brand select service hotels in markets with high barriers to entry. |
|||||
| Ransomware | Tharisa id16154 View details | Cyprus | Communication / Marketing | ||
|
Tharisa is an integrated resource group critical to the energy transition and decarbonisation of economies. It incorporates mining, processing, exploration, and the beneficiation, marketing, sales, and logistics of PGMs and chrome concentrates, using innovation and technology as enablers. |
|||||
| Ransomware | Watsonville Community Hospital id15997 View details | United States | Healthcare / Pharma | ||
|
Watsonville Community Hospital is community healthcare provider; a 106-bed facility that offers a comprehensive range of medical and surgical services to the culturally diverse tri-county area along California’s Central Coast. |
|||||
| Ransomware | Blue Yonder id15891 View details | United States | Transportation / Travel / Logistics | ||
|
Blue Yonder Group, Inc. (formerly JDA Software Group) is an American supply chain management company operating as an independent subsidiary of Panasonic. Founded in 1985, the company is headquartered in Scottsdale, Arizona, with offices globally. Its acquisitions have included Yantriks, RedPrairie, i2 Technologies, Manugistics, E3, Intactix, and Arthur |
|||||
| Ransomware | Département de La Réunion id15525 View details | France | Energy | ||
|
La Réunion se situe au Sud de l’Océan Indien, entre l’île Maurice et Madagascar, à près de 9500km de la métropole et compte plus 850 000 habitants. Elle constitue à la fois un département et une région d'outre-mer français (DROM). |
|||||
| Ransomware | Conseil scolaire Viamonde id15381 View details | Canada | Education | ||
|
The Conseil scolaire Viamonde is a public-secular French first language school board, and manages elementary and secondary schools in the Ontario Peninsula and the Greater Golden Horseshoe. |
|||||
| Ransomware | Lebenshilfe Heinsberg id15380 View details | Germany | Other | ||
|
Die Bundesvereinigung Lebenshilfe e. V. ist ein 1958 gegründeter gemeinnütziger Verein. Sie versteht sich als Selbsthilfevereinigung, Eltern-, Fach- und Trägerverband, insbesondere für Menschen mit Behinderung und ihren Familien. Die Lebenshilfe unterstützt somit Menschen zur gleichberechtigten Teilhabe in der Gesellschaft. |
|||||
| Ransomware | Oman Oil id15379 View details | Oman | Energy | ||
|
OQ, formerly known as Oman Oil Company, is an energy investment company headquartered in Muscat, Oman. |
|||||
| Ransomware | Culligan id15378 View details | France | Communication / Marketing | ||
|
Founded in 1936, Culligan Entreprises is a global water treatment company specializing in premium services and water treatment solutions. |
|||||
| Ransomware | Nifast id15377 View details | United States | Manufacturing / Engineering | ||
|
Operating from 1987, Nifast is a specialist of fastening components and automobile parts with a broad business scope of vendor approval, sourcing, quality assurance and delivery. |
|||||