ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 17, 2026

Product Serial: D-2026-07-17a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed in deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries, including RansomHouse, INTERLOCK, Chaos, PEAR, and The Gentlemen, the last of which listed 17 new alleged targets in a single day.
Unauthorized Access Marketplace: Threat actors advertised network access for sale, including SSH and FortiGate access purportedly to an unnamed India-based telecommunications company (XSS) and over 30,000 alleged business-level API keys offered on the Exploit forum (chemda5lek3asba).
Vulnerability and Tooling Commercialization: An actor advertised an alleged TeamViewer SSRF exploit for sale on DarkForums (shredder00).
Hacktivism: Pro-Palestinian groups claimed disruptive operations via Telegram, including an ongoing DDoS attack against Saudi Arabia's Qiwa ministry platform (313 Team) and a defacement of the BSD Group website (Cyber Islamic Resistance), the latter observed live at time of reporting.
Data Dissemination and Telemetry: Forums hosted several breach and data-sale claims referencing government and private-sector organizations, including a 4.6 GB dataset purportedly tied to India's BDL and the MRSAM missile program (slepra) and a claimed breach of Abbott Laboratories data (ShadowByt3S). Separately, credential intelligence systems ingested over 1.6 billion combined compromised account (CAC) and botnet records between June 19 and July 16, 2026.