ZeroFox Daily Deep and Dark Web Intelligence - July 20, 2026

ZeroFox Daily Deep and Dark Web Intelligence - July 20, 2026

Product Serial: D-2026-07-20a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple extortion groups posted new leak site entries, including INTERLOCK, INC, BlackNevas, UnSafe, and The Gentlemen.
• Vulnerability Disclosures: Reported flaws in widely deployed software, most notably an unauthenticated remote code execution vulnerability in WordPress Core (CVE-2026-63030) and a heap-based buffer overflow in 7-Zip (CVE-2026-14266).
• Data Dissemination and Telemetry: Threat actors on DarkForums and Exploit advertised data allegedly concerning Al-Nahrain Islamic Bank, as well as Australian personally identifiable information (PII) and financial documents. Separately, credential intelligence systems ingested over 1.4 billion compromised account credentials (CAC) and botnet records between June 22 and July 19, 2026.