ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 28, 2026

Product Serial: D-2026-08-28a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including INC Ransomware, EMPERADOR Ransomware, KRYBIT Ransomware, Anubis Ransomware, and Qilin Ransomware.
Unauthorized Access Marketplace: Threat actors advertised Fortinet VPN and network access allegedly tied to a U.S.-based finance and insurance company and a France-based manufacturing company, on deep and dark web (DDW) forum Exploit.
Hacktivism: Pro-Palestinian group "313 Team" claimed a DDoS attack targeting Proton's internal servers, on Telegram.
AI Infrastructure Targeting: A well-regarded actor, "ShinyHunters," expressed intent to buy AWS access keys with Amazon Bedrock permissions specifically targeting Claude models.
New Leak Site Emergence: A new data leak site, "Cinder," identified on the dark web.
Data Dissemination and Telemetry: Forums hosted several data sale claims, including an 8 GB dataset allegedly tied to Scale AI and data allegedly associated with Canada-based individuals. Separately, credential intelligence systems ingested over 2.3 billion combined compromised account credentials (CAC) and botnet CAC between July 31 and August 27, 2026.