ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 18, 2026

Product Serial: D-2026-09-18a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Storm Ransomware, Brain Cipher Ransomware, The Gentlemen Ransomware, BlackNevas Ransomware, and Akira Ransomware.
Unauthorized Access Marketplace: Threat actors advertised web shell access allegedly tied to an undisclosed U.S.-based company and network access allegedly tied to 11 distinct companies worldwide, on deep and dark web (DDW) forums Exploit and PwnForums.
New Leak Site Emergence: Two new dark web leak sites identified: "SPIRALS" and "ENDZONE."
Data Dissemination and Telemetry: Threat actors hosted several data sale claims, including an alleged database tied to UK-based MT Global and a Saudi Arabia PII database exceeding 3.1 million records. Credential systems ingested over 1.21 billion combined compromised account credentials (CAC) and botnet CAC between August 21 and September 17, 2026.