ZeroFox Daily Deep and Dark Web Intelligence - October 22, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 22, 2026

Product Serial: D-2026-10-22a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including LeakedData Ransomware, INTERLOCK Ransomware, Akira Ransomware, Everest, and Uways Qarani, and ZeroFox observed a new leak site named “Mimori.”
• Unauthorized Access Marketplace: An untested threat actor on DDW forum Exploit advertised VPN and RDP access with domain user rights allegedly tied to a U.S.-based commercial and residential construction company.
• Data Dissemination and Telemetry: Threat actors on DDW forums posted several breach and data sale claims, including PII databases allegedly associated with organizations in the EU and the U.S. and a data set purportedly tied to the Switzerland-based marketplace Ricardo.