ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 22, 2026

Product Serial: D-2026-09-22a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Leakeddata, Termite, Qilin, Doommageddon, Nightspire, Bravox, and Lockbit 5.0.
Unauthorized Access Marketplace: Threat actors advertised privileged network access—RDWeb, Fortinet, and VPN access—to organizations in the pharmaceutical, telecommunications, and logistics sectors, including access purportedly to Ecorodovias, on deep and dark web (DDW) PwnForums and Exploit.
Vulnerability and Tooling Commercialization: A threat actor advertised an alleged N-day exploit targeting Zimbra on the Russian-language DDW forum RehubCom.
Data Dissemination and Telemetry: Threat actor posted several data sale claims referencing government and private-sector organizations, including alleged passenger data tied to flydubai and an auction for 1.9 million U.S.-based credit card records. Separately, credential intelligence systems ingested over 1.1 billion combined compromised account credentials (CAC) and botnet CAC between August 25 and September 21, 2026 reporting period.