ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 26, 2026

Product Serial: D-2026-08-26a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including DYSPHOR1A Ransomware, Storm Ransomware, Akira Ransomware, BEAST Ransomware, Dark Project, and Booba Project Ransomware, while The Gentlemen Ransomware added 21 new victims in a notable activity surge.
Unauthorized Access Marketplace: Threat actors advertised network and SimpleHelp access allegedly tied to a U.S.-based cloud and AI technology company and a U.S.-based business services company, on deep and dark web (DDW) forums PwnForums and Exploit.
Data Dissemination and Telemetry: Forums hosted several data sale and leak claims referencing government and private-sector organizations, including data allegedly tied to the Ministry of Interior of the Palestinian territories, a possible repost of an earlier Visa breach, and a 51.02 GB dataset allegedly tied to appointment platform Yocale. Separately, credential intelligence systems ingested over 2.26 billion combined compromised account credentials (CAC) and botnet records between July 29 and August 25, 2026.