ZeroFox Daily Deep and Dark Web Intelligence - October 8, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 8, 2026

Product Serial: D-2026-10-08a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including LockBit 5.0, Qilin, Inc, Interlock, and Vypr.
• Unauthorized Access Marketplace: An untested actor advertised an auction for administrator-level access to an ERP system allegedly tied to an unnamed Argentina-based retail company on DDW forum Exploit.
• Extortion Infrastructure Emergence: A new data leak site, "SCARLETTGROUP," was identified, and a dark web site claimed to host an archive allegedly associated with the Silent Ransom Group (SRG).
• Data Dissemination and Telemetry: A dark web site claimed to host data allegedly tied to multiple U.S.-based organizations, the Israel Police, and high-profile U.S. and Israeli individuals. Threat actors also posted several data sale claims referencing a U.S. fintech company (FDCTech), Uganda Airlines, the Government of Bahrain, and U.S.- and Canada-based business-owner leads. Separately, credential intelligence systems ingested over 1.6 billion combined compromised account credentials (CAC) and botnet CAC records between September 10 and October 7, 2026.