ZeroFox Daily Deep and Dark Web Intelligence -September 9, 2026

ZeroFox Daily Deep and Dark Web Intelligence - September 09, 2026

Product Serial: D-2026-09-09a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including SafePay Ransomware, Eclipse Ransomware, Qilin Ransomware, and The Gentlemen Ransomware.
• Unauthorized Access Marketplace: Threat actors advertised network, RDP, and VPN access allegedly tied to an unnamed U.S.-based healthcare company, an unnamed Serbia-based company, and three undisclosed Portugal-based companies, on deep and dark web (DDW) PwnForums and Exploit.
• Vulnerability and Tooling Commercialization: Threat actors advertised alleged vulnerabilities/exploits including a Windows local privilege escalation exploit advertised.
• Hacktivism and State-Linked Cyberattacks: A pro-Iran actor group, "APT IRAN," claimed via Telegram to have conducted cyberattacks against telecommunications and water infrastructure in Texas.
• Data Dissemination and Telemetry: Forums hosted data sale claims referencing internal documents allegedly tied to the SpaceX Starshield program and a data set allegedly tied to Italy-based financial institutions. Separately, credential intelligence systems ingested over 1.9 billion combined compromised account credentials (CAC) and botnet CAC between August 12 and September 8, 2026 reporting period.