ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 12, 2026

Product Serial: D-2026-08-12a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat groups posted new leak site entries, including Qilin Ransomware, The Gentlemen Ransomware, and Space Bears Ransomware.
Unauthorized Access Marketplace: Threat actors advertised VNC, VPN, RDP, and FortiGate access, including an access bundle purportedly tied to over 400 U.S.-based companies, on deep and dark web forums.
Critical Infrastructure Attack Claim: A pro-Iran threat actor group, "APT IRAN," claimed joint responsibility with "CyberAv3ngers" for the Minnesota water infrastructure incident on Telegram.
Data Dissemination and Telemetry: The ShinyHunters leak site posted a listing targeting Metabase. Separately, credential intelligence systems ingested over 1.5 billion combined compromised account credentials (CAC) and botnet records between July 15 and August 11, 2026.