Admirals Trading Data Breach

AuditTeam listed Admirals Trading on its leak site on October 13, 2026. Admirals Trading is a United Arab Emirates-based organization operating within the Financial Services sector. SOCRadar’s analysis of stealer-log data revealed a broad credential exposure profile that included access to identity infrastructure, internal portals, and customer-facing systems. AuditTeam is an emerging ransomware group that appears to be focusing on Middle Eastern financial institutions and trading organizations. In the 60 days prior to this claim, the group targeted multiple companies based in the UAE and the wider GCC region. Their activity suggests familiarity with Oracle Cloud and Microsoft 365 deployments, which are common in regional financial sector environments.

SOCRadar flagged the domain admirals[.]ae in stealer-log data sampled prior to the ransomware group’s claim. The returned credentials targeted four distinct systems, indicating a broad exposure of sensitive access information. These systems included Microsoft 365 / Entra ID (login.microsoftonline[.]com) for corporate identity infrastructure, an internal trading portal (admsfape.admirals[.]ae) for internal operations access, Oracle Cloud (login.oracle[.]com) for enterprise platform access, and the Freshdesk support platform, a customer-facing system. The most recent record associated with this exposure was dated August 3, 2026. The breadth of exposed systems, encompassing identity infrastructure, internal portals, and customer-facing support services, represents one of the most comprehensive credential exposure profiles observed in recent reporting. This pattern is consistent with an infostealer-enabled initial access chain affecting multiple credential types across the organization. However, direct attribution of the initial access to AuditTeam’s specific methods remains unconfirmed. The identified credential sets provide potential entry vectors into Admirals Trading’s environment. Specifically, the exposure includes access to Entra ID credentials, internal trading operations access, Oracle Cloud credentials, and customer support platform credentials. The presence of all four sets in criminal markets simultaneously suggests a severe exposure profile for a financial services organization. Next Steps: – Conduct an immediate credential hygiene review across all four exposed platforms. – Review Entra ID sign-in logs for anomalous access occurring from August 2026 onwards. – Enforce Multi-Factor Authentication (MFA) on all external-facing identity providers and Oracle Cloud access. – Assess customer data exposure via the Freshdesk platform and determine notification obligations under relevant UAE data protection regulations.