ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 8, 2026

Product Serial: D-2026-07-08a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed in deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries, including Akira, DragonForce, Chaos, BASHE, and SafePay.
Unauthorized Access Marketplace: Actors advertised high-privilege network access bundles on the Russian-language forums XSS and Exploit, including an SSH and FortiGate super-admin bundle purportedly spanning 3,197 Mexico-based companies (APL-BRK) and a Fortinet VPN access auction likely affecting 300 undisclosed companies (Big-Bro).
Vulnerability Disclosures: Newly disclosed vulnerabilities include two authentication flaws in BeyondTrust Remote Support and Privileged Remote Access (CVE-2026-40139, CVE-2026-40138) and a use-after-free in the Linux Kernel KVM x86 shadow MMU (CVE-2026-53359).
Data Dissemination and Telemetry: Forums and channels hosted several breach and data-sale claims referencing government and private-sector organizations — notably a screenshots purporting to show AT&T dashboard access (Scattered Lapsus$ Hunters) — alongside listings against Nayax, Pakistan International Airlines, and Follow Health. Separately, credential intelligence systems ingested over 1.8 billion combined compromised account (CAC) and botnet records between June 10 and July 7, 2026.