ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 27, 2026

Product Serial: D-2026-08-27a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including FALCON, Qilin Ransomware, Dire Wolf Ransomware, Abyss Ransomware, and Chaos Ransomware.
Unauthorized Access Marketplace: Threat actors advertised network access allegedly tied to Instituto Português do Mar e da Atmosfera and an unnamed Qatar-based pharmaceutical company, on deep and dark web (DDW) forums Spear and PwnForums.
Vulnerability and Tooling Commercialization: Threat actors advertised a macOS local privilege escalation zero-day exploit, and a vulnerability targeting Canada-based company Chatr.
Data Dissemination and Telemetry: Threat actor posted several data sale and leak claims, including alleged data tied to Police Nationale Togolaise and U.S.-based companies CGETC and ABC Movers. Separately, credential intelligence systems ingested over 2.26 billion combined compromised account credentials (CAC) and botnet CAC between July 30 and August 26, 2026.