ZeroFox Daily Deep and Dark Web Intelligence - September 14, 2026

ZeroFox Daily Deep and Dark Web Intelligence - September 14, 2026

Product Serial: D-2026-09-14a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Wallstreet Ransomware, RansomHouse, Rhysida Ransomware, and CHAOS Ransomware.
• Vulnerability and Tooling Commercialization: An untested actor advertised an alleged Windows 11 local privilege escalation (LPE) zero-day exploit for sale on the deep and dark web (DDW) forum PwnForums.
• Data Dissemination and Telemetry: Forums hosted several breach and data sale claims, notably a well-reputed actor advertising five corporate data sets on the DDW forum Exploit. Separately, credential intelligence systems ingested over 1.7 billion combined compromised account credentials (CAC) and botnet CAC between August 17 and September 13, 2026.