ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 2, 2026

Product Serial: D-2026-09-02a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries, including The Gentlemen Ransomware, LockBit 5.0 Ransomware, Akira Ransomware, INTERLOCK Ransomware, and Payouts King Ransomware. Ransomware-as-a-Service Expansion: A threat actor advertised a new RaaS partnership program called "Wallstreet" on DUTY-FREE. Data Dissemination and Telemetry: Forums and leak sites hosted several significant breach and data-sale claims, including an identity-verification marketplace ("NEXUS") claiming over 160 million breached identity documents, roughly 549 GB allegedly exfiltrated from Manchester Airports Group by "FulcrumSec," and over 1.7 million combined alleged customer leads tied to Veronica's Insurance, Labcito, and Fixtman. Separately, credential intelligence systems ingested over 2.24 billion combined compromised account (CAC) and botnet records between August 5 and September 1, 2026.