Termite
A double extortion ransomware group that Cyble assesses as essentially a rebrand of Babuk. It claimed the November 2024 attack on Blue Yonder, which caused knock-on problems for UK supermarkets.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Termite's clearest UK link is indirect. It claimed the November 2024 attack on supply chain software provider Blue Yonder,2 and The Record reports that several major UK supermarket brands reported production issues related to that attack.5
Cyble analysed a Termite binary and assessed it as essentially a rebrand of Babuk.1 Infosecurity reports that Broadcom also noted the link.2
Termite was linked early on to the December 2024 exploitation of Cleo file transfer software, with Huntress calling it the likely perpetrator while saying it was not in the attribution business.6 Clop then claimed those attacks, and BleepingComputer says they more closely matched Clop's earlier activity.7 Blue Yonder said it had no reason to believe the Cleo flaw was connected to its November incident.5 We therefore do not list a Cleo CVE for this group.
The UK impact came through a supplier. We would include critical software suppliers in incident planning, since their outage can stop your operations.
How It Attacks
Only the encryption stage is documented in detail, from Cyble's analysis of one binary.1 How Termite gets in has not been established in the sources we opened.
- 1
Clear the Way
Stops selected services and processes, including backup and database software.
- 2
Block Recovery
Deletes Volume Shadow Copies and empties the Recycle Bin.
- 3
Encrypt
Encrypts local drives and, depending on the arguments used, network shares.
- 4
Extort
Leaves a ransom note and threatens to publish stolen data on a leak site.
Key Techniques
Based on Cyble's mapping of one binary.1 Termite has no ATT&CK v20 entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1204.002 | Malicious File | Execution | The ransomware file is run by a user. |
| T1083 | File and Directory Discovery | Discovery | Lists folders for encryption. |
| T1135 | Network Share Discovery | Discovery | Targets network shares and paths. |
| T1070.004 | File Deletion | Stealth | Deletes itself after running. |
| T1489 | Service Stop | Impact | Stops selected services before encryption. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies to hinder recovery. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts data for extortion. |
Key Events
Reportedly active from this point.2
Starts posting on its leak site, according to Comparitech.3 Blue Yonder suffers a ransomware incident that Termite later claims.2
Cyble publishes its analysis.1 Cleo exploitation is first linked to Termite, then claimed by Clop.6,7
BleepingComputer reports MalBeacon's observation of a Velvet Tempest intrusion using an IP address linked to Termite tool staging. Termite was not deployed, and the activity was seen in a replica environment.4
Defences That Matter
Plan for Supplier Failure
- Identify software suppliers your operations cannot run without.
- Agree manual workarounds and test them.
Prepare for Encryption
- Keep offline, immutable backups and test that they restore.
- Include virtualisation hosts and backup servers in recovery tests.
Watch for Hands-On Activity
- Monitor for unapproved remote access tools, renamed file transfer utilities and large outbound transfers.
- Alert on attempts to stop security tools or delete shadow copies.
What If Your Critical Supplier Went Down?
We can help you test how your business would cope with a ransomware attack on a key supplier.
Sources
- Cyble: A technical look at the new Termite ransomware that hit Blue Yonder, 6 December 2024
- Infosecurity Magazine: Unmasking Termite, the ransomware gang claiming the Blue Yonder attack, 9 December 2024
- Comparitech: Ransomware gang claims attack on California hospital, 12 December 2024
- BleepingComputer: Termite ransomware breaches linked to ClickFix CastleRAT attacks, 7 March 2026
- The Record: Blue Yonder says November ransomware attack not connected to Cleo vulnerability, 27 December 2024
- Dark Reading: 'Termite' ransomware likely behind Cleo zero-day attacks, 10 December 2024
- BleepingComputer: Clop ransomware claims responsibility for Cleo data theft attacks, 15 December 2024
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.