ZeroFox Daily Deep and Dark Web Intelligence - August 4, 2026

ZeroFox Daily Deep and Dark Web Intelligence - August 4, 2026

Product Serial: D-2026-08-04a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple extortion groups, including Qilin, INC, ShinyHunters, and CRPx0, posted new leak site entries.
• Unauthorized Access Marketplace: Threat actors advertised access to healthcare, manufacturing, and AI/technology targets on Exploit, PwnForums, and BreachForums.
• Vulnerability Exploitation: An untested actor offered an alleged remote code execution exploit for CVE-2024-38077.
• Vulnerability Disclosure: An authentication bypass vulnerability was disclosed in N-able N-central (CVE-2026-18577), a widely deployed remote monitoring and management platform.
• Data Dissemination and Telemetry: Two critical-severity claims surfaced on Exploit: leaked U.S. and U.K. proxy lists allegedly sourced from NetNut and data sets advertised as U.S. business leads. Separately, credential intelligence systems ingested over 1.3 billion combined compromised account (CAC) and botnet records between July 7 and August 3, 2026.