ZeroFox Daily Deep and Dark Web Intelligence - October 21, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 21, 2026

Product Serial: D-2026-10-21a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Nitrogen Ransomware, Qilin Ransomware, LeakedData, REDACT, n0n Ransomware, and SCARLETTGROUP, and ZeroFox observed a new leak site named “WHITEARMOR.”
• Unauthorized Access Marketplace: Threat actors advertised high-privilege access, including Fortinet access with domain administrator rights allegedly associated with an Argentina-based business services company and full chain hosting access, including Cloudways credentials and GitHub tokens, purportedly to a U.S.-based B2B digital agency.
• Vulnerability and Tooling Commercialization: Threat actors offered a BYOVD driver exploit kit with proof-of-concept source code claimed to bypass HVCI.
• Data Dissemination and Telemetry: Threat actors posted several breach and data-sale claims, including cryptographic keys purportedly tied to eMudhra certificate authorities, customer data purportedly tied to State Bank of India, and PII data sets advertised against a U.S.-based transportation company and the Brazil-based UNINTER platform.