ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 1, 2026

Product Serial: D-2026-09-01a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including The Gentlemen Ransomware, Wallstreet, Dire Wolf Ransomware, LockBit 5.0 Ransomware, INC Ransomware, and Brain Cipher Ransomware.
Unauthorized Access Marketplace: Threat actors advertised webmail and VPN access allegedly tied to the Italian State Police, an Iran-based pharmaceutical company, and a U.S.-based production company, on deep and dark web (DDW) forums PwnForums and Exploit.
Vulnerability and Tooling Commercialization: A threat actor advertised various alleged zero-day exploits spanning web-app, Windows LPE, macOS LPE, and RCE vectors on Exploit.
Data Dissemination and Telemetry: Forums hosted several data sale claims, including alleged databases tied to flydubai, U.S.-based Sugarwish, and an undisclosed fintech banking platform. Separately, credential intelligence systems ingested over 2.24 billion combined compromised account credentials (CAC) and botnet CAC between August 4 and August 31, 2026.