ZeroFox Daily Deep and Dark Web Intelligence - September 4, 2026

ZeroFox Daily Deep and Dark Web Intelligence - September 4, 2026

Product Serial: D-2026-09-04a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat groups posted new leak site entries, including Storm Ransomware, Vexy Ransomware, and SETTRA Ransomware.
• Unauthorized Access Marketplace: Threat actors advertised network access tied to three U.S.-based education entities and admin credentials tied to over 7,500 ISPs, on deep and dark web (DDW) forums PwnForums and DarkForums.
• Vulnerability and Tooling Commercialization: Threat actors advertised alleged zero-days targeting Microsoft Office and Windows Server 2025.
• AI Infrastructure Attack Claim: Pro-Iran group "Gorz Rostam" claimed responsibility for disruptions to ChatGPT and Claude AI on Telegram.
• Data Dissemination and Telemetry: Forums hosted data sale claims including Laboratorio Reig Jofré and an unnamed Spain-based insurtech platform. Credential systems ingested over 2.29 billion combined compromised account credentials (CAC) and botnet records between August 7 and September 3, 2026.