ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 24, 2026

Product Serial: D-2026-08-24a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including ShinyHunters, The Gentlemen, and PEAR, with Qilin and CoinbaseCartel adding 15 and 14 new entries respectively.
Unauthorized Access Marketplace: Threat actors advertised network access to multiple organizations, including Fortinet VPN with domain-admin rights to a U.S.-based legal services firm, and a FortiGate/FortiCloud/SSH/SSL-VPN bundle with domain-admin rights to a Canada-based company, across deep and dark web (DDW) forums Exploit and DarkForums.
Emerging Ransomware Operation: A new actor operating as "Black-Lotus" announced itself as a ransomware group on Telegram, outlining its modus operandi and rules of engagement.
Data Dissemination and Telemetry: Threat actors hosted several breach and data sale claims, notably an alleged visa records of foreigners in Turkey. Separately, credential intelligence systems ingested over 2.4 billion combined compromised account credentials (CAC) and botnet CAC during the July 27 to August 23, 2026 reporting period.