ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 29, 2026

Product Serial: D-2026-07-29a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed in deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries over the past 24 hours, including CoinbaseCartel, Everest, SafePay, NightSpire, and ExfilSquad.
Unauthorized Access Marketplace: Threat actors advertised access sales on PwnForums and Exploit, including alleged SSH access to a U.S.-based healthcare insurer and RDP access purportedly tied to a UAE-based aerospace and defense company.
Vulnerability and Tooling Commercialization: Two vulnerability disclosures surfaced, including an unauthenticated RCE in vBulletin (CVE-2026-61511) and an OS command injection flaw in Arista VeloCloud Orchestrator On-Prem (CVE-2026-16812).
Data Dissemination and Telemetry: Forums hosted several data sale claims and processed breach entries referencing organizations such as Shopee, Lenovo, and Euroins, alongside additional processed records tied to healthcare, education, and non-profit-sector entities. Separately, credential intelligence systems ingested over 1.3 billion combined compromised account credentials (CAC) and botnet records during the July 1 to 29, 2026 reporting period.