Termite
Termite is a ransomware group with a financial motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 17 countries, including the United States and the United Kingdom. It uses 23 MITRE ATT&CK techniques and exploits 1 known CVE.
Also known as
- Termite Ransomware
- Velvet Tempest
- DEV-0504
- Techniques
- 23
- Exploited CVEs
- 1
- First seen
- Nov 17, 2024
- Last seen
- Aug 22, 2026
- Record updated
Who They Target.
Sectors · 15
Countries · 17
Labelsransomware
About Termite.
Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blue Yonder, claiming 680 GB of exfiltrated data and disrupting major customers including Starbucks.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.