ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 10, 2026

Product Serial: D-2026-07-10a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed in deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries, including Qilin, Nova, and Payload.
Unauthorized Access Marketplace: Threat actors advertised network access for sale on Russian-language forums, including an SSH and FortiGate super-admin bundle claimed to cover 1,985 undisclosed UAE-based companies (XSS) and RDP and Fortinet access purportedly to an unnamed Israel-based business services and software testing firm (Exploit).
Vulnerability Disclosures: A privilege-escalation vulnerability was disclosed in the Microsoft Defender Malware Protection Engine (CVE-2026-50656).
Emerging Extortion Infrastructure: A new ransomware data leak site, "CRPx0," was observed listing six alleged targets, all in the healthcare sector across the United States and China.
Data Dissemination and Telemetry: Forums hosted several breach and data-sale claims referencing government and private-sector organizations, including alleged Indian Armed Forces data (Slepra) and data purportedly tied to France's national health insurer L'Assurance Maladie (yaserbakhtiary0111). Separately, credential intelligence systems ingested over 1.8 billion combined compromised account (CAC) and botnet records between June 12 and July 9, 2026.