ZeroFox Daily Deep and Dark Web Intelligence - October 12, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 12, 2026

Product Serial: D-2026-10-12a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actors posted new leak site entries, including Run Some Wares Ransomware, NightSpire Ransomware, SCARLETTGROUP, cry0 Ransomware, and INTERLOCK Ransomware, while The Gentlemen Ransomware and Qilin Ransomware added 43 and 18 new victims respectively in notable activity surges.
• Ransomware-as-a-Service Expansion: A threat actor announced a return to operations with the launch of a new RaaS model dubbed “GLOBAL RAAS,” on DDW forum T1erOne.
• Vulnerability and Tooling Commercialization: A threat actor advertised a zero-day RCE exploit for the DHIS2 platform on DDW forum BreachForums.
• New Leak Site Emergence: A new data leak site, “NAMELESS 511,” identifed on the dark web.
• Data Dissemination and Telemetry: Threat actors posted several data sale and leak claims, including alleged databases tied to Angi, AmCham Oman, and Icon Cancer Centre Australia, on DDW forums Exploit, DarkForums, and PwnForums, alongside a smaller processed breach set. Credential systems ingested over 1.59 billion combined compromised account credentials (CAC) and botnet CAC records between September 14 and October 11, 2026.