Skip to main content
Darkfield

Operator dossier

Termite is a ransomware operator currently active on public leak sites. Darkfield has indexed 48 public victims claimed by this operator between November 17, 2024 and June 9, 2026. Termite is a recently emerged ransomware group that first appeared in November 2024, operating with apparent financial motivations based on their targeting patterns across multiple high-value sectors. The group's origin and affiliations remain largely undocumented by major threat intelligence providers, though their targeting of primarily Western nations including the United States, France, United Kingdom, Germany, and Canada suggests a non-Western operational base. With 39 documented victims across healthcare, telecommunications, business services, and technology sectors within just a few months of operation, Termite demonstrates an aggressive deployment strategy, though specific details regarding their initial access vectors, encryption methodologies, and whether they employ double or triple extortion tactics have not been publicly documented by established security research organizations. The group's relatively recent emergence means that notable high-profile campaigns and specific technical indicators have not yet been extensively analyzed or reported by authoritative sources such as CISA, FBI, or major cybersecurity firms. Termite appears to remain active as of early 2025, though the limited public documentation suggests they may be a smaller-scale operation or have not yet attracted significant attention from major threat intelligence organizations.

Most-targeted sectors

Most-affected countries

Recent disclosures by Termite

All 48 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Termite →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Termite

48 victims indexed · first seen 2 years ago · last activity 1 month ago

48
Victims indexed
#109 of 364 tracked operators
1y 7m
Active period
Nov 2024 → Jun 2026
16
Countries hit
top United States · 21

At a glance

Status
active
First seen
2 years ago
Last activity
1 month ago
Onion sites
3 known endpoints
Primary sector
Not Found · 9 hits

About

Termite is a recently emerged ransomware group that first appeared in November 2024, operating with apparent financial motivations based on their targeting patterns across multiple high-value sectors. The group's origin and affiliations remain largely undocumented by major threat intelligence providers, though their targeting of primarily Western nations including the United States, France, United Kingdom, Germany, and Canada suggests a non-Western operational base. With 39 documented victims across healthcare, telecommunications, business services, and technology sectors within just a few months of operation, Termite demonstrates an aggressive deployment strategy, though specific details regarding their initial access vectors, encryption methodologies, and whether they employ double or triple extortion tactics have not been publicly documented by established security research organizations. The group's relatively recent emergence means that notable high-profile campaigns and specific technical indicators have not yet been extensively analyzed or reported by authoritative sources such as CISA, FBI, or major cybersecurity firms. Termite appears to remain active as of early 2025, though the limited public documentation suggests they may be a smaller-scale operation or have not yet attracted significant attention from major threat intelligence organizations.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

14 months
2024-11-01T00:00:00+00:00 · 62024-12-01T00:00:00+00:00 · 32025-01-01T00:00:00+00:00 · 22025-02-01T00:00:00+00:00 · 72025-03-01T00:00:00+00:00 · 12025-04-01T00:00:00+00:00 · 32025-05-01T00:00:00+00:00 · 12025-09-01T00:00:00+00:00 · 52025-12-01T00:00:00+00:00 · 22026-02-01T00:00:00+00:00 · 62026-03-01T00:00:00+00:00 · 32026-04-01T00:00:00+00:00 · 12026-05-01T00:00:00+00:00 · 52026-06-01T00:00:00+00:00 · 3
2024-11-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
21
🇺🇸 United States
5
🇫🇷 France
4
🇬🇧 United Kingdom
4
🇩🇪 Germany
2
🇨🇦 Canada
2
🇳🇴 Norway
1
🇨🇾 Cyprus
1
United States dossier →United States dossier →France dossier →United Kingdom dossier →

Top sectors

Healthcare
9
Manufacturing
6
Telecommunication
4
Business Services
4
Technology
3
Education
2
Agriculture and Food Production
2
Government
1
Healthcare dossier →Manufacturing dossier →Telecommunication dossier →Business Services dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

3 known
  • http://termitelfvhutinrgpe55siktisskbqntkuq7ojidg42zh26avekq6qd.onion
  • http://termitelfvhutinrgpe55siktisskbqntkuq7ojidg42zh26avekq6qd.onion/api/blog/blogs
  • http://termiteuslbumdge2zmfmfcsrvmvsfe4gvyudc5j6cdnisnhtftvokid.onion

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Termite posts a victim.

Add Termite to your watchlist — Pro pings you within 5 minutes of any new Termite leak-site post, Telegram callout, or affiliate-rebrand inference.