Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Blue Termite · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

Blue Termite

  • Cloudy Omega
  • Emdivi

state sponsor · Unknown

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2015-5119

Analyst brief

misp-galaxy

Blue Termite is a group of suspected Chinese origin active in Japan.

Observed targets (as stated by the sources)

1 countries · 2 sectors
JapanAssessed origin: China

assessed origin · Chinaobserved targets · 1

countries · 1

  • Japan

sectors · 2

  • Government
  • Private sector

as stated by MISP galaxy / ransomware.live — not inferred

CVEs Blue Termite is cited as exploiting

none on KEV
  1. CVE-2015-51192026-10-17
    1. “Originally, the main infection vector of the APT was spear-phishing emails. Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit (CVE-2015-5119, the one leaked from The Hacking Team incident).”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2015Blue Termite (Internet Watch)Kaspersky ↗

Take it with you

keyless · no signup

References

2 sources
  1. 1.securelist.com/blog/research/71876/new-activity-of-the-blue-termite-a…
  2. 2.cfr.org/interactive/cyber-operations/blue-termite

Track Blue Termite on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.