File · termite · Crime · ransomware.live · refreshed 2026-10-06 · on the wire
termite
sigil · no ATT&CK coverage stated
Last 30 days
last seen 8 d ago- seen against
- United States
- sectors
- Financial Services · Manufacturing · Not Found · Other
What changed
ledger · newest first- —17 d agovictimsvictim count 6 → 7 (+1)
- —24 d agoresurfacedback on the wire — nothing in the previous 30 days
- —24 d agovictimsvictim count 3 → 6 (+3)
Analyst brief
ransomware.liveTermite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blue Yonder, claiming 680 GB of exfiltrated data and disrupting major customers including Starbucks.
Observed targets (as stated by the sources)
1 countries · 4 sectorsassessed originnot stated by sourcesobserved targets · 1
countries · 1
- United States
sectors · 4
- Manufacturing
- Other
- Financial Services
- Not Found
as stated by MISP galaxy / ransomware.live — not inferred
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 5 | ≈ 1.7 / month | above the lifetime rate 12 |
- Victims observed
- 5
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 1.7 / month
- Last 30 days
- above the lifetime rate 12
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
On the wire
1 dispatch · newest firstPrimary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
1 sourceTrack termite on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.