Description Summary
Babuk source-code based; Nov 2024 attack on Blue Yonder (claimed 680GB).
Threat Actor
Built on leaked Babuk source code; encryption + exfiltration; hit Blue Yonder (supply-chain SaaS).
Technical Indicators
Encryption Extension
.termite (retains Babuk 'choung dong looks like hot dog' file marker)
Encryption Algorithm
Babuk-derived
Ransom Note Name
Not publicly reported
Targeted Industries
Supply chain / logistics software (cross-sector)
First Seen
~April 2024 (prominence November 2024)
Last Seen
Active
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |