# HYFLOCK claims Saudi ERP firm Nodhom

Published: 2026-10-13 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/2a0344e3-53ae-5888-b4af-aff55fe00a35/hyflock-claims-saudi-erp-firm-nodhom

> Emerging extortion group HYFLOCK claims to have breached Saudi cloud-ERP vendor Nodhom; claim is unverified and attack details are absent.

Ransomware.live has indexed a listing from a newly-observed extortion group calling itself HYFLOCK, claiming an attack on Nodhom, a Riyadh-based cloud ERP provider for SMBs owned by Ettesaq Ltd. The posting is a leak-site entry rather than a technical advisory: it gives company background (founded 2015, unfunded, competitors include Workday, Oracle and SAP) and contact details, but no information on the intrusion vector, data exfiltrated, or ransomware payload used. The source explicitly flags HYFLOCK as an emerging group whose claims should be treated with caution pending independent verification.

Supplementary exposure data cited includes HudsonRock infostealer telemetry showing two third-party employee credential exposures (no directly compromised employee/user accounts), and a ParanoidLab exposure report noting 647 passwords and 332 flagged as critical associated with the victim's domain — likely from historical credential-stuffing/breach datasets rather than this specific incident. DNS records listed (Rackspace/emailsrvr.com MX hosts, SPF entries referencing shared hosting ranges) reflect Nodhom's legitimate mail and hosting setup and are not attacker infrastructure. No cloud/SaaS services were detected as compromised.

Defenders at Nodhom or using its ERP platform should monitor for data leaks referencing the company, review third-party/vendor credential exposure, and watch for confirmation or denial of the claim as HYFLOCK's credibility is established over time. No CVEs, malware samples, or TTP details were disclosed in this listing.

## Mentioned in this report

- Threat actors: Hyflock

Source reporting: https://www.ransomware.live/id/bm9kaG9tLmNvbUBIWUZMT0NL

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2a0344e3-53ae-5888-b4af-aff55fe00a35/hyflock-claims-saudi-erp-firm-nodhom.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup