ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 9, 2026

Product Serial: D-2026-07-09a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed in deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries, including Akira, INC, BravoX, Everest, and CMD Organization.
Unauthorized Access Marketplace: Threat actors advertised network access for sale across English- and Russian-language forums, including root-level SSH access purportedly to an unnamed U.S. healthcare insurance company (DarkForums) and a bulk VPN-access auction claimed to span roughly 500 undisclosed organizations (Exploit).
Vulnerability Disclosures: Two new command-injection vulnerabilities were disclosed in Ubiquiti UniFi products — UniFi OS (CVE-2026-54402) and the UniFi Connect application (CVE-2026-50746).
Data Dissemination and Telemetry: Forums hosted several breach and data-sale claims referencing government and private-sector organizations, including alleged Nike and Alcon data (Nocturne) and a 50 GB dataset purportedly tied to Pakistan's state-owned Heavy Industries Taxila (Cyb3R_Shubh4M). Separately, credential intelligence systems ingested over 1.8 billion combined compromised account (CAC) and botnet records between June 11 and July 8, 2026.