ZeroFox Daily Deep and Dark Web Intelligence - November 4, 2026

ZeroFox Daily Deep and Dark Web Intelligence - November 4, 2026

Product Serial: D-2026-11-04a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox's Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Booba Project Ransomware, Climax Inc. Ransomware, INTERLOCK Ransomware, and FALCON, and ZeroFox observed new leak sites named “DESTELLO,” “AOQIN LEAKS,” and “OBSOFT.”
• Unauthorized Access Marketplace: Threat actors on DDW forums PwnForums and Exploit advertised network access, including auctions for access allegedly tied to Indonesia-based and Spain-based hotel chains and hotel property management system dashboards purportedly tied to Latin American hotels. Another listing offered SSL-VPN access allegedly associated with two U.S.-based healthcare and energy companies.
• Vulnerability and Tooling Commercialization: An untested threat actor on the forum BreachForums advertised an alleged zero-day exploit affecting Turborepo.
• Data Dissemination and Telemetry: Threat actors on the forums posted several data sale claims, including data allegedly associated with Pegasus Airlines and the U.S.-based company TopDevz, and a data set allegedly containing over 800,000 U.S.-based software engineering leads offered for USD 500.