Termite is rapidly making itself a reputation within the ransomware area. The risk actor group claimed accountability for a November cyberattack on Blue Yonder, a provide chain administration options firm, in keeping with CyberScoop. Shortly afterward, the group was linked with zero day attacks on several Cleo file transfer products.
How a lot harm is that this group doing, and what can we learn about Termite’s techniques and motives?
New Gang, Outdated Ransomware
Termite is quickly burrowing into the ransomware scene. Whereas its identify is new, the group is utilizing a modified model of an older ransomware pressure: Babuk. This pressure of ransomware has been on regulation enforcement’s radar for fairly a while. In 2023, the US Division of Justice indicted a Russian national for utilizing numerous ransomware variants, together with Babuk, to focus on victims in a number of sectors.
Babuk first arrived on the scene in December 2020, and it was utilized in greater than 65 assaults. Actors utilizing this pressure demanded greater than $49 million in ransoms, netting as much as $13 million in funds, in keeping with the US Justice Division.
Whereas Babuk has reemerged, totally different actors might very nicely be behind its use in Termite’s current exploits.
“Babuk ransomware was leaked again in 2021. The builder is principally simply the supply code in order that anybody can compile the encrypting instrument after which run their very own ransomware marketing campaign,” says Aaron Walton, risk intelligence analyst at Expel, a managed detection and response supplier.
How is Termite placing the ransomware to work?
“Researchers have discovered that the group’s ransomware makes use of a double extortion methodology, which is quite common as of late,” Mark Manglicmot, senior vice chairman of safety companies at cybersecurity firm Arctic Wolf, tells InformationWeek. “They extort the sufferer for a decryptor to stop the discharge of stolen information publicly.”
A brand new ransomware group isn’t routinely noteworthy, however Termite’s aggression and large-scale assaults early on in its formation make it a gaggle to observe.
“Normally, these teams begin with smaller cases after which they type of construct as much as one thing larger, however this new group didn’t waste any time,” says Manglicmot.
Termite’s Victims
Termite seems to be a financially motivated risk actor. “They’re attacking victims in several international locations throughout totally different verticals,” says Jon Miller, CEO and cofounder of anti-ransomware platform Halcyon. “The truth that they’re executing with out a theme makes me really feel like they’re opportunist-style hackers.”
Termite has hit 10 victims up to now, in sectors together with automotive manufacturing, oil and gasoline, and authorities, in keeping with Infosecurity Journal.
The group does have victims listed on its leak website, however it’s potential there are extra. “Perhaps we might guess that there is likely to be one other handful which have paid ransom or have negotiated to remain off of [the] information leak website,” says Walton.
Given the group’s aggression and opportunistic strategy, it might conceivably execute disruptive assaults on different giant firms.
“Termite appears to be daring sufficient to influence a lot of organizations,” says Walton. “That’s usually a dangerous tactic that actually brings the warmth on you a lot quicker than simply … hitting one group and avoiding something that would severely harm provide traces.”
The assault on Blue Yonder induced important disruption to many organizations. Termite claims it has 16,000 e-mail lists and greater than 200,000 insurance coverage paperwork amongst a complete of 680GB of stolen information, in keeping with Infosecurity Journal.
The ransomware attack caused outages for Blue Yonder prospects, together with Starbucks and UK grocery store firms Morrisons and Sainsbury’s, in keeping with Bleeping Laptop.
Termite’s exploitation of a vulnerability in a number of Cleo merchandise is impacting victims in multiple sectors, together with shopper merchandise, meals, delivery, and trucking, in keeping with Huntress Labs.
Ongoing Ransomware Dangers
Whether or not Termite is right here to remain or not, ransomware continues to be a threat to enterprises. “With sure areas of the globe being destabilized, we might see much more of a lot of these behaviors pop up,” says Manglicmot.
As enterprise leaders assess the danger their organizations face, Miller advocates for studying in regards to the frequent techniques that ransomware teams use to focus on victims.
“It’s actually essential for folks to exit and educate themselves on what ransomware teams are concentrating on their vertical or like-sized firms,” he says. “The vast majority of these teams use the very same techniques again and again in all their totally different victims.”
