ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 21, 2026

Product Serial: D-2026-07-21a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Monthly Threat Spotlight: The June 2026 Threat Spotlight covers trends in ransomware operations, zero-day exploits, and supply-chain disruptions.
Ransomware and Digital Extortion: Multiple digital extortion groups posted new leak-site entries, including Qilin, SafePay, 0day Syndicate, and Anubis.
Unauthorized Access Marketplace: Actors advertised high-privilege network, VPN, and VNC access on Exploit, PwnForums, and DarkForums, with claimed targets including the Indonesian National Police Cyber Division and Lifetime Brands, alongside unnamed government and financial-services entities in Argentina, Europe, and Iran.
Vulnerability Disclosure: A sandbox escape and remote code execution vulnerability was disclosed in the ServiceNow AI Platform (CVE-2026-6875).
Hacktivism: Pro-Palestinian group 313 Team claimed DDoS attacks against Airbnb via its official Telegram channel.
Data Dissemination and Telemetry: Forums hosted several breach and data sale claims referencing organizations including Just Eat, PappyJoe Enterprise, and the Courts of Georgia, with one processed listing (msgsports[.]com) exceeding 9.8 million records; separately, credential intelligence systems ingested over 1.4 billion combined compromised account credentials (CAC) and botnet CAC records between June 23 and July 20, 2026.