---
title: Termite Ransomware
url: https://www.broadcom.com/support/security-center/protection-bulletin/termite-ransomware
description: Termite is a ransomware actor (data theft, extortion and encryption) that has recently claimed several organizations as victims in France, Canada, Germany, Oman, and the USA, targeting sectors including government agencies, education, disability support services, oil and gas, water treatment, and automotive manufacturing. The actor's logo features a blue stylized termite integrated with circuit-like pathways.
---

# Termite Ransomware

November 24, 2024

Termite is a ransomware actor (data theft, extortion and encryption) that has recently claimed several organizations as victims in France, Canada, Germany, Oman, and the USA, targeting sectors including government agencies, education, disability support services, oil and gas, water treatment, and automotive manufacturing. The actor's logo features a blue stylized termite integrated with circuit-like pathways.

They appear to use a modified version of the infamous Babuk ransomware. When the ransomware is executed on a machine, it'll encrypt targeted files and add a .termite extension. It also drops a ransom note (How To Restore Your Files.txt) with brief content. The attackers provide their Onion website, along with a support token and an email address. When victims connect to their website, they are presented with a form designed for direct communication with the attackers. The form includes fields for entering the company name, a description of the situation, the victim's full name, an email address, and a "support token."

The full modus operandi is still unknown, but the actor is likely using generic TTPs that most ransomware actors leverage, such as gaining initial access via phishing, vulnerabilities, or purchased credentials and escalating privileges to take control of networks. They exfiltrate sensitive data while encrypting files, threatening to leak stolen information on public sites if the ransom isn’t paid. They disable backups and defenses, ensuring victims cannot easily recover data. Communication is handled through ransom notes, encrypted channels, and TOR websites, with demands for cryptocurrency payments.

Symantec protects you from this threat, identified by the following:

**Carbon Black-based**

- Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

**File-based**

- Ransom.Babuk

**Machine Learning-based**

- Heur.AdvML.B