ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 7, 2026

Product Serial: D-2026-09-07a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including ShinyHunters, Space Bears, PEAR, Wallstreet, DragonForce, Panzer, and Karma.
Unauthorized Access Marketplace: Threat actors advertised high-privilege access across several sectors, including alleged network access purportedly tied to a U.S. healthcare services company, plus additional claims against a Central American ministry and an Iran-based construction firm.
Data Dissemination and Telemetry: Forums hosted breach and data sale claims including entries. Separately, credential intelligence systems ingested over 1.9 billion combined compromised account credentials (CAC) and botnet CAC between August 10 and September 6, 2026.