ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 15, 2026

Product Serial: D-2026-07-15a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed in deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries, including DragonForce, SafePay, Payouts King, D1R, and ShinyHunters.
Unauthorized Access Marketplace: Threat actors advertised network access for sale, including RDP and shell access with domain-admin rights purportedly to an unnamed Germany-based electronics manufacturer (Exploit) and VNC, SSH, and web panel access to an unnamed Hong Kong-based VoIP MSP (DarkForums), alongside a claim of remote access to a Spain-based PC tied to a CaixaBank account (DarkForums).
Vulnerability Disclosures: Several notable vulnerabilities were disclosed, including privilege escalation in Microsoft AD Federation Services (CVE-2026-56155) and SharePoint Server (CVE-2026-56164), SSRF in SonicWall SMA1000 (CVE-2026-15409), and memory corruption in SAP NetWeaver AS ABAP (CVE-2026-44747).
Data Dissemination and Telemetry: Forums hosted several breach and data-sale claims referencing government and private-sector organizations, including a dataset purportedly tied to multiple U.S. government agencies (thesinon) and alleged Conasems data leaked (888). Separately, credential intelligence systems ingested over 1.8 billion combined compromised account (CAC) and botnet records between June 17 and July 14, 2026.