# Nightspire ransomware claims Furama Bukit Bintang hotel compromise

Published: 2026-07-27 · Severity: high · Sectors: retail, technology
Canonical: https://vorant.io/reports/a3233f48-9b0f-5b90-be38-b5a23eb69735/nightspire-ransomware-claims-furama-bukit-bintang-hotel-compromise

> Nightspire ransomware gang claims breach of Furama Bukit Bintang hotel with 201 compromised user accounts and 14 third-party credentials.

Nightspire ransomware operators have posted a claim of compromise against Furama Bukit Bintang, a hotel chain property. According to the posting on ransomware.live, the attack resulted in 4 compromised employees and 201 compromised user accounts. The attackers also obtained 14 third-party employee credentials and identified 56 points on the victim's external attack surface. DNS records for the victim's domain were also enumerated as part of reconnaissance or post-breach activity.

The claim carries the standard caveats of ransomware gang postings: the actual scope of exfiltration, encryption, or extortion demands cannot be verified from the public posting alone. The article provides no technical indicators, exploitation method, or timeline. Defenders should treat this as confirmation that the victim organization has been targeted, and organizations in the hospitality sector should review access logs, credential compromise, and ransom communications if they share supply chain or service relationships with this victim.

## Mentioned in this report

- Threat actors: nightspire
- Malware: NightSpire

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/RnVyYW1hIEJ1a2l0IEJpbnRhbmdAbmlnaHRzcGlyZQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a3233f48-9b0f-5b90-be38-b5a23eb69735/nightspire-ransomware-claims-furama-bukit-bintang-hotel-compromise.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup