Alfameli Group Data Breach

Orova ransomware claimed Alfameli Group on its leak site on October 13, 2026. This was the group’s third victim claimed that day and notably featured the most sensitive credential exposure, including Microsoft 365/Entra ID credentials and internal employee portal access, with active records dating as recently as September 27, 2026. Alfameli Group is a diversified conglomerate operating across multiple business units in the Middle East. This claim fits Orova’s recent pattern of targeting Microsoft-centric IT environments within its 2026 victim set. For a conglomerate like Alfameli Group, compromised identity infrastructure, particularly with privileged access, can facilitate broad lateral movement across its entire corporate network, potentially affecting multiple business units. The timing of the exposed credentials—approximately two weeks before the ransomware claim—strongly suggests an infostealer-enabled breach, though direct attribution of these specific logs to Orova’s initial access remains unconfirmed.

SOCRadar flagged the domain alfameli[.]com in stealer-log data sampled prior to the ransomware claim. The returned records indicated exposure related to two key systems: Microsoft 365 / Entra ID (login.microsoftonline[.]com), which serves as the corporate identity infrastructure, and the Alfameli employee portal (eportal.alfameli[.]com), an internal access system. These exposures are significant because compromised identity credentials, especially for cloud-based services like Microsoft 365 and internal portals, are a common vector for initial access in ransomware attacks. The most recent credential exposure recorded was on September 27, 2026, roughly two weeks before Orova’s public claim. The presence of fresh Microsoft identity and employee portal access credentials in underground markets, followed by a ransomware claim within a short timeframe, is a strong indicator of an infostealer-derived compromise. While the direct link between these specific logs and Orova’s initial access cannot be definitively confirmed, the exposure profile strongly supports the possibility of an infostealer-enabled breach impacting Alfameli Group. Organizations with similar profiles should review their conditional access policies and privileged identity management configurations. Implementing zero-trust segmentation between business units is crucial to prevent the propagation of a compromise across the entire conglomerate. Additionally, a thorough review of Entra ID sign-in logs for any unexamined authentication events from unfamiliar locations or devices around September 27, 2026, is recommended, as this period likely represents the origin of the intrusion.