ZeroFox Daily Deep and Dark Web Intelligence - October 5, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 5, 2026

Product Serial: D-2026-10-05a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including ShinyHunters, DeadLock, Akira, Rhysida, and Booba Project.
• Unauthorized Access Marketplace: Threat actors advertised administrative, Citrix (domain user rights) and VPN access on deep and dark web (DDW) forums Exploit, DarkForums, and PwnForums.
• Vulnerability and Tooling Commercialization: Well-reputed actors on Exploit offered three Windows zero-days, including a kernel LPE and an OEM-signed kernel-mode driver (WDF/KMDF) flaw, plus a LPE targeting commercial remote administration software.
• Data Dissemination and Telemetry: Threat actors on Exploit, PwnForums, and BreachForums advertised or leaked data sets allegedly tied to the Ministry of Foreign Affairs of Ukraine, Elbaite, Jettly, and the Royal Belgian Football Association, plus a multi-country PII set. Separately, credential intelligence systems ingested over 1.6 billion combined compromised account credentials (CAC) and botnet CAC records between September 7 and October 4, 2026.