The threat actor gains initial access, likely via phishing or exploitation, then moves laterally to encrypt files on the network.
Tag: Termite
Engage Report: Termite Ransomware
The Termite ransomware attempts to delete all Shadow Copies on the victim’s machine by executing the vssadmin.exe process with the necessary arguments. This is done to prevent the victim from recovering their system to a state before the files were encrypted.