ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 19, 2026

Product Serial: D-2026-08-19a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including ShinyHunters, SECUROTROP Ransomware, Dire Wolf Ransomware, Qilin Ransomware, and Clop Ransomware.
Unauthorized Access Marketplace: Threat actors advertised RDWeb, SSH, FortiGate, and RDP access allegedly tied to a U.S.-based manufacturing company, a U.S.-based retail company, and an undisclosed major crypto exchange, across deep and dark web (DDW) forums Exploit, XSS, DarkForums, and Spear.
Vulnerability and Tooling Commercialization: Actors disclosed and advertised exploits including, a leaked target list and public POC for a Citrix NetScaler pre-auth RCE (CVE-2026-8451, CVE-2026-8452), and an alleged RCE exploit targeting the Chainlink network.
New Leak Site Emergence: A new data leak site, "xpl0itrs," surfaced listing four disclosed and two redacted entities.
Data Dissemination and Telemetry: A threat actor leaked a database allegedly associated with WorkL, a UK-based digital workplace intelligence platform. Separately, credential intelligence systems ingested over 2.26 billion combined compromised account credentials (CAC) and botnet CAC between July 22 and August 18, 2026.