ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 30, 2026

Product Serial: D-2026-07-30a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups, including Akira, ExfilSquad, Leaknet, CRPx0, and Booba Project, posted new leak site entries.
Unauthorized Access Marketplace: A threat actor advertised Citrix access with domain user rights purportedly tied to an undisclosed U.S.-based company on the Russian-language forum DUTY-FREE.
Vulnerability Disclosures: Four disclosures were observed affecting widely deployed enterprise infrastructure, including an authentication bypass in VMware vCenter Server (CVE-2026-59309) and arbitrary file read with remote code execution (RCE) in Ruby on Rails Active Storage (CVE-2026-66066).
Data Dissemination and Telemetry: Threat actors advertised several data sets allegedly tied to healthcare, gambling, and consumer targets across DarkForums, Exploit, and XSS—including claims referencing Portugal-based Companhia União Fabril (CUF). Separately, credential intelligence systems ingested over 1.3 billion combined compromised account credentials (CAC) and botnet records between July 1 and July 29, 2026.