ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 21, 2026

Product Serial: D-2026-08-21a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Dire Wolf Ransomware, LockBit 5.0 Ransomware, Insomnia, INTERLOCK Ransomware, Akira Ransomware, and Qilin Ransomware, with Dire Wolf listing 13 additional victims.
Unauthorized Access Marketplace: Threat actors advertised unauthorized accesses allegedly tied to a Packagist developer account, a France-based real estate company, and an undisclosed gambling platform, all on the deep and dark web (DDW) forum Exploit.
New Leak Site Emergence: Two new dark web leak sites were identified—"DYSPHOR1A," indicating ransomware operations with seven listed victims, and "Sovcali," listing one victim.
Critical Infrastructure and Defense Sector Claims: Threat group "Infrastructure Destruction Squad" claimed a data breach and exfiltration against Pratt & Whitney via Telegram.
Data Dissemination and Telemetry: Threat actor hosted several data sale claims, including a data breach targeting Kimber America and a leaked database allegedly associated with Sports 2000. Separately, credential intelligence systems ingested over 2.35 billion combined compromised account credentials (CAC) and botnet CAC between July 24 and August 20, 2026.