ZeroFox Daily Deep and Dark Web Intelligence - August 5, 2026

ZeroFox Daily Deep and Dark Web Intelligence - August 5, 2026

Product Serial: D-2026-08-05a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: ransomware groups posted new leak-site entries, including Everest, Anubis, SafePay, and The Gentlemen; Clop listed 42 new redacted entries in the past 24 hours.
• Unauthorized Access Marketplace: Actors advertised high-privilege network access across six listings on Exploit, DUTY-FREE, and BreachForums.
• Vulnerability Disclosure: A critical code-injection vulnerability was disclosed in IBM Langflow OSS (CVE-2026-9198).
• Emerging Extortion Infrastructure: A new ransomware leak site, "OROVA," was observed on a Tor onion address already listing 24 entries.
• Data Dissemination and Telemetry: A moderately credible actor advertised data allegedly exfiltrated from France-based supermarket chain Intermarché on PwnForums. Separately, credential intelligence systems ingested over 1.2 billion combined compromised account (CAC) and botnet records between July 8 and August 4, 2026.