ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - September 24, 2026

Product Serial: D-2026-09-24a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Shadowbyt3$ Ransomware, Space Bears Ransomware, Booba Project Ransomware, Emperador Ransomware, and Lockbit 5.0 Ransomware.
Unauthorized Access Marketplace: Threat actors advertised network, FortiClient VPN, and FortiGate access allegedly tied to an unnamed U.S.-based government entity, an unnamed Germany-based hosting company, and an undisclosed TV channel group, on deep and dark web (DDW) forums Exploit and BreachForums.
Tooling Commercialization: A threat actor advertised an alleged uncensored AI model service, "Uncensored.monster."
Dark Web Ecosystem Developments: A new leak site, "EXFS TEAM," was identified.
Data Dissemination and Telemetry: Threat actors posted data leak and asset colclaims referencing Horizane Santé and France-based luxury conglomerate LVMH. Separately, credential intelligence systems ingested over 1.4 billion combined compromised account credentials (CAC) and botnet CAC records between August 27 and September 23, 2026 reporting period.