ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 31, 2026

Product Serial: D-2026-08-31a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actors posted new leak site entries, including Rhysida Ransomware, ShinyHunters, LockBit 5.0 Ransomware, Eclipse Ransomware, Storm Ransomware, and EMPERADOR Ransomware.
Unauthorized Access Marketplace: Threat actors advertised network and shell access allegedly tied to a U.S.-based AI FinTech company and a UAE-based transportation company, on the predominantly English- and Russian-language deep and dark web (DDW) forums PwnForums and Exploit.
Vulnerability and Tooling Commercialization: A threat actor advertised multiple alleged zero-day vulnerabilities targeting WordPress plugins and Apache Fineract.
Hacktivism: Pro-Palestinian group "313 Team" claimed DDoS attacks against the FBI's National Instant Criminal Background Check System.
New Leak Site Emergence: Two new dark web leak sites identified—Meowciety403, listing three alleged victims, and ZaWoo, listing 16 alleged victims including several unnamed entries.
Data Dissemination and Telemetry: Separately, credential intelligence systems ingested over 2.23 billion combined compromised account credentials (CAC) and botnet CAC between August 3 and August 30, 2026.