Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

TERMITE · Threat actor profile

// THREAT ACTOR

TERMITE_

Active

TERMITE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of TERMITE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

43 Victims tracked
2 / 5 Active mirrors
2024-11-17 First listing
2026-07-28 Most recent

Victims by year

  • 2026 17
  • 2025 17
  • 2024 9

Leak site mirrors

5 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • termiteuslbumdge2zmfmfcsrvmvsfe4gvyudc5j6cdnisnhtftvokid.onion Termite snapshot · 2026-08-06 21:05
  • pqw3hepvky2pgyyv6dupvx47cm2gxzwop6dfei3i67dj76tdj6alplqd.onion Index of / snapshot · 2024-12-17 07:26
  • 4xklh64cl2lymm6n5xywinfq4wlchgugvv5a77pm3pta34svnohwl2id.onion Index of / snapshot · 2025-05-08 09:19
  • wc4mc3oupskb2c3q4ba6tlf6tq5mdfoevsgfcotbnbsr4tbqoaomftid.onion Index of / snapshot · 2025-09-10 23:01
  • y4bdg56uaznmbptf7dgp5xn3sjyyh4qodqjrsbziqatnyapmiqqctgid.onion Index of / snapshot · 2026-08-06 21:35

Recent victims

The 50 most recent victims claimed by TERMITE. Total in the index: 43.

Date listed Victim Description
2026-07-28 https://affiniahealthcare.org/ Affinia Healthcare
2026-07-28 https://www.jdyoung.com/ JD Young
2026-06-10 https://calfresh.ca.gov/ Cal Fresh
2026-06-09 https://www.wieseusa.com/ Wiese USA
2026-06-09 https://www.rolandmachinery.com/ Roland Machinery
2026-05-30 https://www.imminet.com/ Indiana Mills and Manufacturing
2026-05-29 https://www.uei.edu/ UEI College
2026-05-16 https://www.ramarfoods.com/ RAMAR FOODS INTERNATIONAL
2026-04-17 https://www.lanap.com/ Millennium Dental Technologies
2026-03-17 https://www.nollandtam.com/ Noll and Tam Architects
2026-03-07 https://www.cityofhuntington.com/ City of Huntington
2026-03-03 https://www.bartramtrail.net/ Bartram Trail Surveying
2026-02-25 https://www.joneshaberlaw.com/ Jones Haber
2026-02-25 https://www.siskiyoutelephone.com/ The Siskiyou Telephone
2026-02-25 https://www.artsbma.org/ Birmingham Museum of Art
2026-02-24 https://insightchicago.com/ Insight Hospital & Medical Center Chicago
2026-02-02 https://www.fhcenters.org/ Family Health Center
2025-12-25 https://www.hermesmedical.com/ Hermes Medical Solutions
2025-12-17 https://medhelpclinics.com/ MedHelp
2025-09-16 https://www.npgco.com/ News-Press & Gazette Co.
2025-05-06 https://www.lgm.fr/ LGM
2025-05-01 https://www.ushio.eu/ Ushio
2025-04-12 https://www.bjorklund.no/ Bjørklund
2025-04-11 https://weareonit.com/ On IT
2025-03-16 https://www.perrigo.com/ Perrigo Company
2025-02-26 https://lbl.london/ London Belgravia
2025-02-26 https://nationallegalservice.co.uk/ National Legal Service
2025-02-26 https://rooksrider.co.uk/ Rooks Rider Solicitors
2025-02-26 https://www.arcandco.com/ Arcandco
2025-02-26 https://www.genea.com.au/ Genea
2025-02-20 https://www.ligentia.com/ Ligentia
2025-02-12 https://www.cesi.fr/ CESI
2025-01-30 www.zschimmer-schwarz.com Zschimmer and Schwarz
2025-01-08 https://www.huntingtonhotelgroup.com/ Huntington Hotel Group
2024-12-17 https://tharisa.com/ Tharisa
2024-12-11 http://watsonvillehospital.com Watsonville Community Hospital
2024-12-06 https://blueyonder.com Blue Yonder
2024-11-20 https://www.departement974.fr/ Département de La Réunion
2024-11-17 https://csviamonde.ca/ Conseil scolaire Viamonde
2024-11-17 https://www.lebenshilfe-heinsberg.de/ Lebenshilfe Heinsberg
2024-11-17 https://oq.com/ Oman Oil
2024-11-17 https://www.culligan.fr/ Culligan
2024-11-17 https://www.nifast.com Nifast

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.