ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 20, 2026

Product Serial: D-2026-08-20a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including xpl0itrs, Everest, LeakedData, and Akira.
Unauthorized Access Marketplace: Threat actor "Florence" advertised network access to unnamed UK telecommunications and Malaysia-based investment-holdings organizations on deep and dark web (DDW) forums PwnForums, while "morganfreeman666" auctioned FortiGate access purportedly to Hong Kong-based OP Mall on DDW forums Exploit.
Ransomware-as-a-Service Recruitment: Threat actor "Straightonumberone" advertised a new RaaS affiliate program dubbed "Moondancer Ransomware" on DDW forums DarkForums.
Data Dissemination and Telemetry: Threat actor posted numerous breach and data sale claims of government and public-sector targets—including data allegedly tied to Mexico's Ministry of Finance (Secretaría de Hacienda y Crédito Público), Costa Rica's electoral tribunal (Tribunal Supremo de Elecciones), France's Ministry of National Education, and South Africa's Anova Health Institute. Separately, credential intelligence systems ingested over 2.3 billion combined compromised account credentials (CAC) and botnet CAC during the July 23 to August 19, 2026 reporting period.