ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 8, 2026

Product Serial: D-2026-09-08a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including ShinyHunters, Qilin Ransomware, The Gentlemen Ransomware, and Dire Wolf Ransomware, among others.
Unauthorized Access Marketplace: Threat actors advertised network access purportedly to an unnamed U.S.-based software company and an unnamed Vienna-based government entity, spanning the software and government sectors, on deep and dark web (DDW) forums PwnForums and DarkForums.
Vulnerability and Tooling Commercialization: Advertised vulnerabilities/exploits included an alleged zero-day exploits for Hyper-V VM escape and Magneto 2 RCE.
Hacktivism and DDoS: A pro-Palestinian actor group, "313 Team," claimed via Telegram to have conducted a DDoS attack against King Abdulaziz International Airport.
Data Dissemination and Telemetry: Forums hosted several data breach and sale claims referencing organizations tied to Condé Nast, Hospital Alemán and OSDEPYM, and a U.S.-based life insurance portfolio linked to Infineo. Separately, credential intelligence systems ingested over 2 billion combined compromised account credentials (CAC) and botnet CAC between August 11 and September 7, 2026 reporting period.