ZeroFox Daily Deep and Dark Web Intelligence - October 14, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 14, 2026

Product Serial: D-2026-10-14a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Threat actor groups posted new leak site entries, including n0n Ransomware, Qilin Ransomware, Metaencryptor Ransomware, and Dark Project Ransomware.
• Unauthorized Access Marketplace: A threat actor advertised Fortinet access allegedly tied to both a UK-based financial services company and a U.S.-based insurance company, and web panel access allegedly tied to Nigeria-based banking platform Finova, on DDW forum Exploit.
• New Leak Site Emergence: A new ransomware leak site, “HYFLOCK,” identifed on the dark web.
• Data Dissemination and Telemetry: Threat actors posted several data sale claims, including alleged data tied to Geidea and NEXT Insurance, on DDW forums PwnForums and Exploit. Credential systems ingested over 1.56 billion combined compromised account credentials (CAC) and botnet CAC records between September 16 and October 13, 2026.