Termite Ransomware Recovery: The Babuk Rebrand Behind the Blue Yonder Attack

Termite appeared in late 2024 and became widely known when it claimed the November 2024 attack on Blue Yonder, a supply-chain software provider whose outage affected large retailers; the group said it had taken 680 GB of data. ransomware.live counts about 55 victim claims, with new posts in October 2026.

Cyble's researchers examined a Termite binary and concluded that it is essentially a rebrand of Babuk, the ransomware whose source code leaked in 2021. Like Babuk, it appends a signature string to the end of every encrypted file.

Termite runs double extortion: data is stolen first and the victim is threatened with publication if the decryptor is not bought. Kroll described a case in which the RedLine information stealer collected credentials that were later used for access, and the encryptor was deployed inside a VMware ESXi environment. Before and after encryption Termite deletes all shadow copies and empties the recycle bin to block the simple recovery routes.

No public decryptor exists for Termite. We examine the encrypted VMDK virtual disks, SQL Server and Oracle databases and Veeam backups directly, measure what was encrypted, and recover the virtual machines, tables and files from the parts that are still intact.

Do not reinstall the ESXi hosts or delete the encrypted files. Keep a copy and contact us for a free assessment. No data, no charge.