ZeroFox Daily Deep and Dark Web Intelligence - October 13, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 13, 2026

Product Serial: D-2026-10-13a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actors posted new leak site entries, including OROVA Ransomware, Termite Ransomware, NightSpire Ransomware, Chaos Ransomware, and INTERLOCK Ransomware, while n0n Ransomware added 38 new victims in a notable activity surge.
• Unauthorized Access Marketplace: A threat actor advertised network access allegedly tied to an unnamed Brazil-based bank on DDW forum Exploit.
• Vulnerability and Tooling Commercialization: A threat actor advertised an alleged WordPress plugin zero-day enabling web shell upload and administrator account creation on Exploit.
• Data Dissemination and Telemetry: Threat actors posted several data sale claims, including alleged data tied to Ampath Laboratories, SoftBank Corp., and a 94,202-record U.S. notary data set, on DDW forums PwnForums, DarkForums, and Exploit. Credential systems ingested over 1.59 billion combined compromised account credentials (CAC) and botnet CAC records between September 15 and October 12, 2026.