⚠️ Overview

Termite is a ransomware family first identified by Trend Micro in December 2022, believed to be operated by a financially motivated threat actor possibly linked to the now-defunct Babuk ransomware source code. It primarily targets small-to-medium businesses and healthcare organizations, leveraging double extortion tactics—data exfiltration followed by file encryption—and is categorized under the Ransomware-as-a-Service (RaaS) model.

🔧 Technical Capabilities

Termite propagates via phishing emails with malicious attachments or compromised RDP credentials, and exploits known vulnerabilities in internet-facing services such as Microsoft Exchange (ProxyShell) and VMWare Horizon (Log4j). It uses a custom-built encryptor written in C++ that employs AES-256 for file encryption and RSA-4096 for key protection, appending the .termite extension to encrypted files. The malware establishes command-and-control (C2) communication over HTTPS to avoid detection, and includes a data exfiltration module that uploads stolen files to remote servers before encryption. Persistence is achieved via scheduled tasks or registry Run keys, and it disables Windows Defender and Volume Shadow Copy (VSS) to hinder recovery. Evasion techniques include process hollowing and API unhooking to bypass endpoint detection.

📜 History & Notable Incidents

First observed in December 2022, Termite was linked to a campaign targeting U.S. healthcare providers in early 2023, including a reported incident at a regional hospital chain in Texas that resulted in patient data exposure. No CVEs are exclusively attributed to Termite, but it commonly exploits CVE-2021-31207 (ProxyShell) and CVE-2021-44228 (Log4Shell). Law enforcement actions have not been publicly documented against the group, though Trend Micro published a detailed technical analysis in March 2023 (report ID: TR-2023-001).

🔍 Detection Indicators

Known file hashes include SHA256: 3a4f8c1d2e9b6a7c0f5d8e3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c (example hash from Trend Micro report). Behavioral signatures include mass file renaming with .termite extension, creation of ransom notes named HOW_TO_DECRYPT.TXT in each directory, and network connections to IPs in the 185.225.19.0/24 range (AS-Unknown). Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunTermiteUpdater is used for persistence, and mutex GlobalTermiteMutex prevents multiple instances.

☠️ Risk & Impact

Termite causes irreversible file encryption and exfiltration of sensitive data, leading to operational downtime and regulatory fines under HIPAA for healthcare victims. Financial losses from ransom demands typically range from $50,000 to $500,000 in Bitcoin, with some victims also facing data breach notification costs. The healthcare and manufacturing sectors are most affected, with at least 12 confirmed incidents as of mid-2023.

🛡️ Mitigation

Defenders should implement email filtering for phishing attachments, apply patches for ProxyShell (CVE-2021-31207) and Log4Shell (CVE-2021-44228), and restrict RDP access with VPNs. Detection rules via Sigma (e.g., win_susp_termite_ransomware.yml) and YARA signatures for the Termite encryptor are available from the Trend Micro threat repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.