HYFLOCK claims Saudi ERP firm Nodhom
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Emerging extortion group HYFLOCK claims to have breached Saudi cloud-ERP vendor Nodhom; claim is unverified and attack details are absent.
Ransomware.live has indexed a listing from a newly-observed extortion group calling itself HYFLOCK, claiming an attack on Nodhom, a Riyadh-based cloud ERP provider for SMBs owned by Ettesaq Ltd. The posting is a leak-site entry rather than a technical advisory: it gives company background (founded 2015, unfunded, competitors include Workday, Oracle and SAP) and contact details, but no information on the intrusion vector, data exfiltrated, or ransomware payload used. The source explicitly flags HYFLOCK as an emerging group whose claims should be treated with caution pending independent verification.
Supplementary exposure data cited includes HudsonRock infostealer telemetry showing two third-party employee credential exposures (no directly compromised employee/user accounts), and a ParanoidLab exposure report noting 647 passwords and 332 flagged as critical associated with the victim's domain — likely from historical credential-stuffing/breach datasets rather than this specific incident. DNS records listed (Rackspace/emailsrvr.com MX hosts, SPF entries referencing shared hosting ranges) reflect Nodhom's legitimate mail and hosting setup and are not attacker infrastructure. No cloud/SaaS services were detected as compromised.
Defenders at Nodhom or using its ERP platform should monitor for data leaks referencing the company, review third-party/vendor credential exposure, and watch for confirmation or denial of the claim as HYFLOCK's credibility is established over time. No CVEs, malware samples, or TTP details were disclosed in this listing.
Mentioned in this report
Source reporting: https://www.ransomware.live/id/bm9kaG9tLmNvbUBIWUZMT0NL
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs