ZeroFox Daily Deep and Dark Web Intelligence - October 20, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 20, 2026

Product Serial: D-2026-10-20a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Qilin, Everest, Play, Vexy, and N0n.
• Unauthorized Access Marketplace: Threat actors on DDW forums PwnForums and Exploit advertised network access, including Fortinet access with domain user rights and root shell access, allegedly tied to unnamed organizations in the insurance, investment, financial services, and telecommunications sectors.
• Vulnerability and Tooling Commercialization: An untested threat actor on XSS advertised an alleged zero-day exploit for the Ledger Wallet desktop application.
• Data Dissemination and Telemetry: Threat actors posted several breach and data sale claims referencing government and private-sector organizations, including data allegedly associated with the U.S. Department of Homeland Security and ZoomInfo. Separately, credential intelligence systems ingested over 1.6 billion combined compromised account credentials (CAC) and botnet CAC records between September 22 and October 19, 2026.