ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 10, 2026

Product Serial: D-2026-08-10a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actors posted new leak site entries, including Qilin, INC, Insomnia, and DragonForce, with The Gentlemen alone listing 24 new entries.
Unauthorized Access Marketplace: Threat actors advertised multiple unauthorized accesses including, administrator level web panel and portal access purportedly to Indonesia's Supreme Court Decision Directory (Direktori Putusan Mahkamah Agung) and Meta's Law Enforcement Online Request System (LEORS) on deep and dark web forums.
Vulnerability and Tooling Commercialization: Threat actor "display107" advertised an allegedly fully operational exploit for CVE-2026-16232 on the Russian-language forum Exploit.
Data Dissemination and Telemetry: Threat actors hosted numerous breach and data sale claims referencing private sector organizations—including databases purportedly tied to Morgan Stanley, internal Azure/Entra ID employee dumps linked to HCLTech and TCS, and engineering data associated with Lucid Motors. Separately, credential intelligence systems ingested over 1.6 billion combined compromised account credentials (CAC) and botnet records during the July 13 to August 9, 2026 reporting period.