ZeroFox Daily Deep and Dark Web Intelligence - October 15, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 15, 2026

Product Serial: D-2026-10-15a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Several threat actor groups posted new leak site entries, including Qilin, DragonForce, LockBit 5.0, BYOD and The Gentlemen. The Gentlemen accounted for most of the activity, listing 31 new entries in one day.
• Unauthorized Access Marketplace: Threat actors on, a DDW forum, Exploit advertised high-privilege access, including administrator web panel access purportedly to India-based Nexa Solutions. Other listings offered RDWeb and RDP/shell access to unnamed organizations in the U.S. insurance and UK events sectors, and an admin panel for a U.S. government-ID lookup service.
• Data Dissemination and Telemetry: Threat actors posted breach claims referencing government and private-sector organizations, including an alleged 135 GB data set tied to the Bangladesh Navy. Separately, credential intelligence systems ingested over 1.56 billion combined compromised account credentials (CAC) and botnet CAC records between September 17 and October 14, 2026.