ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 14, 2026

Product Serial: D-2026-08-14a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entrie, including Storm Ransomware, Clop Ransomware, and The Gentlemen Ransomware, the latter adding 16 new victims.
Unauthorized Access Marketplace: A threat actor advertised administrator-level network access allegedly tied to six Nigeria-based government websites on deep and dark web (DDW) forums DarkForums.
Vulnerability: Disclosures spanning critical and high severity CVEs identified, including Microsoft Windows User Profile Service, Adobe Campaign Classic, and Adobe ColdFusion.
Critical Infrastructure Attack Claims: Pro-Russian groups claimed unauthorized access to industrial control systems (ICS) and surveillance networks, including solar plant surveillance across Europe, and ICS interfaces at a Ukrainian water pumping station and German biogas plant.
Hacktivist DDoS Activity: Pro-Palestinian group "313 Team" claimed a DDoS attack against GitHub infrastructure on Telegram.
Data Dissemination and Telemetry: Forums hosted several data sale claims referencing government and private-sector organizations, including alleged databases tied to Direction générale des Finances publiques and Pantera Capital, alongside smaller breached data sets. Separately, credential intelligence systems ingested over 1.8 billion combined compromised account credentials (CAC) and botnet CAC between July 17 and August 13, 2026.