ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 3, 2026

Product Serial: D-2026-09-03a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak site entries, including MedusaLocker, KRYBIT, Dire Wolf, Akira, BravoX, and INC.
Unauthorized Access Marketplace: Threat actors advertised access to named and unnamed organizations—shipment database management access purportedly to Aymakan on the deep and dark web (DDW) forum DarkForums ("Keishell"), and Dropbox access to an unnamed U.S.-based accounting firm on the deep and dark web (DDW) forum Exploit ("larrypat09").
Vulnerability and Tooling Commercialization: Actor "Dppray" advertised an alleged "FortiVPN" zero-day vulnerability on Exploit.
Emerging Ransomware Operation: A new leak site operating under the name "Vexy" surfaced claiming to be a ransomware group, currently listing one entity.
Vulnerability Disclosure: Two newly disclosed vulnerabilities were reported—an unauthenticated SQL injection leading to remote code execution in Sangoma Switchvox (CVE-2026-9586) and an authentication bypass in JFrog Artifactory (CVE-2026-82329).
Data Dissemination and Telemetry: Forums hosted breach and data-sale claims referencing major private-sector organizations, including databases allegedly tied to Ticketmaster and Plataforma Patria. Separately, credential intelligence systems ingested over 2.2 billion combined compromised account (CAC) and botnet records during the August 6 to September 2, 2026 reporting period.