ZeroFox Daily Deep and Dark Web Intelligence - September 15, 2026

ZeroFox Daily Deep and Dark Web Intelligence - September 15, 2026

Product Serial: D-2026-09-15a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Qilin, MedusaLocker, GENESIS, Eclipse, and Cinder.
• Hacktivism: Pro-Palestinian group "313 Team" claimed to have carried out DDoS attacks against Saudi government and financial targets (the Saudi Ministry of Foreign Affairs and the Saudi National Bank).
• Data Dissemination and Telemetry: Threat actors advertised or leaked data allegedly associated with organizations across the pharmaceutical, energy, and retail sectors, including ROHTO Pharmaceutical Co. and CenterPoint Energy on deep and dark web (DDW) forums PwnForums and BreachForums. Separately, credential intelligence systems ingested over 1.6 billion combined compromised account credentials (CAC) and botnet CAC between August 18 and September 14, 2026 reporting period.