ZeroFox Daily Deep and Dark Web Intelligence - October 9, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 9, 2026

Product Serial: D-2026-10-09a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including LeakedData, Nightspire, UMBRA, and Sovcali.
• Unauthorized Access Marketplace: Threat actors advertised administrator-level access to unnamed organizations, including AnyDesk access to a U.S. legal services company on DDW forum BreachForums and SOCKS proxy access with Domain Administrator rights to a U.S. automotive parts manufacturer on DDW forum Exploit. Another actor on Exploit advertised management panel access and data tied to 14 U.S. luxury hotels.
• Vulnerability and Tooling Commercialization: A well-reputed actor on Exploit advertised an alleged remote code execution (RCE) exploit targeting VMware vCenter Server.
• Ransomware Ecosystem Expansion: Untested actor advertised an affiliate program for a ransomware-as-a-service (RaaS) operation dubbed "FLOCKER" on DDW forum PwnForums.
• Data Dissemination and Telemetry: Threat actors posted several data sale claims referencing Apple, Betashares, and Jubelio (17 GB of data and 6 GB of source code). Separately, credential intelligence systems ingested over 1.6 billion combined compromised account credentials (CAC) and botnet CAC records between September 11 to October 8, 2026.