Aliases: Termite Team, Termite Encryptor Operational Model: Emerging RaaS (Ransomware-as-a-Service) operator with a closed-knit core development team. Ransom Demands: Historical data indicates demands ranging from $500,000 to $2 million, heavily weighted toward the size of the exfiltrated data rather than just encryption impact. Initial Access Vectors: TERMITE distinguishes itself through aggressive exploitation of edge perimeter vulnerabilities. Recent intelligence confirms a heavy reliance on VPN/Security Gateway bypasses (Check Point, Cisco) and Remote Management Software (ConnectWise ScreenConnect). Phishing is observed but secondary to pure exploit-driven access. Double Extortion: Yes. TERMITE maintains a dedicated leak site and frequently threatens to publish patient data (PHI) and intellectual property if negotiations fail. Average Dwell Time: Short. The group operates with a "smash and grab" mentality, often achieving domain admin privileges and exfiltration within 2–5 days of initial compromise before detonating encryption.

Current Campaign Analysis

Sectors Targeted: The latest leak site data (2026-07-29) indicates a sharp pivot toward the Healthcare sector (Affinia Healthcare) and opportunistic targeting of Business Services/Logistics (JD Young). The focus on healthcare suggests TERMITE is actively hunting for high-value PHI to maximize leverage.

Geographic Concentration: A distinct trans-Pacific pattern is emerging:

United States: Primary target for high-value healthcare entities.
China: Secondary target (JD Young), indicating either a supply chain compromise or the use of a region-specific initial access broker.

Victim Profile:

Affinia Healthcare: Large-scale community health provider. High volume of PHI makes them an ideal target for double extortion.
JD Young: Likely mid-market enterprise given the supply chain implications of "Not Found" sector classification in the dataset (often implies mixed-use infrastructure).

Observed Posting Frequency: Low volume, high impact. Only 2 postings in the last 100 listing cycles suggests manual vetting of victims or a focus on bespoke negotiations rather than mass automated spraying.

CVE Connection Analysis: There is a strong correlation between the victim infrastructure (Healthcare/Enterprise) and the CVEs currently exploited by TERMITE:

CVE-2026-50751 (Check Point Security Gateway): Likely the vector for the US Healthcare victim. Healthcare entities heavily rely on Check Point for network segmentation; an IKEv1 bypass allows TERMITE to bypass MFA and VPN controls entirely.
CVE-2026-20131 (Cisco Secure Firewall FMC): A complementary perimeter bypass used to disable logging or alter firewall rules during lateral movement.
CVE-2024-1708 (ConnectWise ScreenConnect): Used for persistence and lateral movement once inside the network, allowing TERMITE operators to deploy payloads directly onto servers.

Detection Engineering

SIGMA Rules

YAML

---
title: Potential Check Point VPN IKEv1 Exploitation CVE-2026-50751
id: 8a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
description: Detects potential exploitation of Check Point Security Gateway IKEv1 improper authentication vulnerability characterized by excessive IKEv1 requests or anomalous auth failures.
status: experimental
date: 2026/07/29
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: check_point
detection:
    selection:
        product: 'VPN-1 & FireWall-1'
        action: 'key_install' or 'key_exchange'
        protocol: 'ikev1'
    condition: selection | count() > 50 by src_ip in 1m
falsepositives:
    - Legitimate misconfigured VPN clients
level: critical
tags:
    - cve.2026.50751
    - attack.initial_access
    - termite

---
title: ConnectWise ScreenConnect Path Traversal Exploitation CVE-2024-1708
id: 9b3c4d5e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
description: Detects suspicious URI patterns associated with the ScreenConnect authentication bypass and path traversal vulnerability.
status: experimental
date: 2026/07/29
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/Bin/ScreenConnect.'
            - '../'
            - '%2e%2e%2f'
    selection_method:
        cs-method: 'GET' or 'POST'
    filter_legit:
        cs-uri-query|contains: 'Login'
    condition: selection_uri and selection_method and not filter_legit
falsepositives:
    - Rare administrative misconfigurations
level: critical
tags:
    - cve.2024.1708
    - attack.lateral_movement
    - termite

---
title: TERMITE Lateral Movement PsExec and WMI
id: 0c4d5e6f-7a8b-6c9d-0e1f-2a3b4c5d6e7f
description: Detects lateral movement patterns consistent with TERMITE operators using PsExec or WMI for remote service creation.
status: experimental
date: 2026/07/29
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection_psexec:
        EventID: 5145
        ShareName: 'IPC$'
        RelativeTargetName|contains: 'PSEXESVC'
    selection_wmi:
        EventID: 4624
        LogonType: 3
        ProcessName|endswith: '\wmiprvse.exe'
    condition: 1 of selection_
falsepositives:
    - Legitimate administrative activity
level: high
tags:
    - attack.lateral_movement
    - termite

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for potential TERMITE lateral movement and staging
// Focuses on PsExec/WMI usage combined with high-volume file access common in staging
let TimeFrame = ago(7d);
DeviceProcessEvents
| where Timestamp >= TimeFrame
| where FileName in~ ('psexec.exe', 'psexec64.exe', 'wmic.exe') or InitiatingProcessFileName in~ ('psexec.exe', 'psexec64.exe')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| join kind=inner (
    DeviceFileEvents
    | where Timestamp >= TimeFrame
    | where ActionType == 'FileCreated' or ActionType == 'FileModified'
    | summarize FileCount = count(), ModifiedFiles = make_set(FileName) by DeviceName, bin(Timestamp, 5m)
    | where FileCount > 50 // Threshold for potential staging activity
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FileCount, ModifiedFiles

PowerShell Rapid Response

PowerShell

# TERMITE Response Script: Check for Suspicious Scheduled Tasks and VSS Manipulation
# Run with elevated privileges

Write-Host "[!] Checking for recently created scheduled tasks (Last 7 Days)..." -ForegroundColor Cyan
$CutoffDate = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $CutoffDate} | Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize

Write-Host "[!] Checking for recent Volume Shadow Copy deletions or unusual interactions..." -ForegroundColor Cyan
# VSS operations are logged in Application Event Log under VSS
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=$CutoffDate} -ErrorAction SilentlyContinue | 
    Where-Object {$_.Message -like '*delete*' -or $_.Message -like '*compress*'} | 
    Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-List

Write-Host "[!] Enumerating active Network Sessions for suspicious RDP/SMB connections..." -ForegroundColor Cyan
# Requires admin rights
Get-NetTCPConnection -State Established | Where-Object {$_.LocalPort -eq 3389 -or $_.LocalPort -eq 445} | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | Format-Table -AutoSize


---

# Incident Response Priorities

T-minus Detection Checklist

VPN Logs: Immediate grep for IKEv1 negotiation failures or spikes on Check Point gateways (indicator of CVE-2026-50751).
Web Server Logs: Scan ConnectWise ScreenConnect logs for path traversal strings (e.g., %2e%2e) in the URI parameters.
Active Directory: Hunt for accounts with "ServicePrincipalName" modifications or sudden additions to Domain Admins groups in the last 48 hours.

Critical Assets for Exfiltration

TERMITE historically prioritizes:

Databases: SQL Server and MySQL backups (full .bak files).
EMR/EHR: Exported patient directories and HL7 message queues.
Financial: Executive email archives and payroll CSVs.

Containment Actions (Order of Urgency)

Isolate: Disconnect VPN concentrators from the core network if suspected exploitation is confirmed; terminate all active ScreenConnect sessions immediately.
Disable: Disable local administrator accounts on critical servers; enforce RDP restriction to specific jump hosts.
Suspend: Suspend service accounts associated with Check Point/Cisco management interfaces.

Hardening Recommendations

Immediate (24h)

Patch CVE-2026-50751 & CVE-2026-20131: Apply the latest Check Point and Cisco hotfixes immediately. If patching is not possible, disable IKEv1 on VPN gateways as a temporary mitigation.
Block ScreenConnect from Internet: Restrict ConnectWise ScreenConnect access to a defined allow-list of admin IPs via firewall; block port 8043/443 from the general internet.
Reset Creds: Force reset of credentials for all local and service accounts exposed to the internet-facing perimeter.

Short-term (2 Weeks)

Network Segmentation: Implement strict Zero Trust segmentation for EHR/PHI databases; ensure lateral movement requires MFA at every hop.
EDR Rollout: Ensure EDR coverage is 100% on all VPN concentrators and management servers.
Audit MFA: Review and enforce phishing-resistant MFA (FIDO2) for all remote access solutions.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

TERMITE Ransomware: Cross-Border Healthcare Targeting & VPN Exploitation Surge