ZeroFox Daily Deep and Dark Web Intelligence - September 21, 2026

ZeroFox Daily Deep and Dark Web Intelligence - September 21, 2026

Product Serial: D-2026-09-21a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Dragonforce ransomware, Threeam ransomware, Rhysida ransomware, and Storm Ransomware.
• Dark Web Ecosystem Developments: A new leak site, "n0n," was observed, and ShinyHunters posted an update on its leak site targeting the threat actor group Cl0p.
• Data Dissemination and Telemetry: Threat actors hosted several data sale and leak claims referencing Pakistan Navy defense procurement documents, Parler, and South Korea's National Health Insurance Service, among others. Separately, credential intelligence systems ingested over 1.1 billion combined compromised account credentials (CAC) and botnet CAC between August 24 and September 20, 2026 reporting period.