termite

Key insights

• •Termite uses double extortion tactics, combining file encryption with data exfiltration.
• •The group is known to leverage phishing emails and software vulnerabilities for initial access.
• •Termite's ransomware appends a '.termite' extension to encrypted files and drops a ransom note named 'How To Restore Your Files.txt'.
• •The operation has been linked to a threat actor tracked as Velvet Tempest (DEV-0504).
• •Termite targets high-value sectors, including supply chain and healthcare.
• •The group is recognized for sophisticated encryption algorithms like ChaCha20.
• •Indicators of compromise include sudden system performance degradation and unauthorized access alerts.