The Underground Economist: Volume 6, Issue 23

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 7:00 AM (EST) on November 5, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Alleged Active Directory Zero-Day Advertised

On November 1, 2026, well-regarded Russian-language threat actor “conductor001” posted on the dark web forum Exploit advertising a “private” zero-day privilege escalation as a service that allegedly targets Windows Active Directory (AD) and allows antivirus and endpoint detection and response (EDR) bypassing. The actor further stated that they perform the executions of the exploit themselves, with a 50 percent success rate.

• The pricing structure blends a flat execution fee of USD 1,000 and an unspecified profit-sharing addition—likely indicating that the actor expects the buyer to deploy ransomware or conduct high-value data extortion once they achieve domain administrator access.
• The threat actor advertised this exploit as private and said they maintain sole access, very likely as a strategy to protect the AD zero-day from being captured by defenders, reverse-engineered, or stolen by rival brokers.

conductor001’s original post on Exploit
Source: ZeroFox Intelligence

The actor claims to have confirmed the zero-day within the following platforms:

• Microsoft Defender for Endpoint
• CrowdStrike Falcon
• SentinelOne
• Carbon Black
• Trend Micro
• Sophos
• ESET
• Kaspersky
• Bitdefender
• Symantec
• Cortex XDR
• Trellix

Conductor001 has been a member of the Exploit forum since 2023 and has garnered a positive reputation score, likely signalling their credibility among other users/interested buyers. The claim of bypassing 12 major EDR/extended detection and response (XDR) platforms using only standard domain user privileges via a single command or PowerShell command highlights the severe risk stemming from undisclosed local privilege escalation vulnerabilities combined with minimal footprint execution.

Threat Actor Recruiting Initial Access Brokers for Exclusive Affiliate Program

On October 26, 2026, an untested threat actor using the alias “nn0nn” advertised an affiliate program recruiting initial access brokers (IABs) for “n0n,” likely referring to the n0n ransomware and digital extortion (R&DE) group on the predominantly Russian-language dark web forum ReHub.

• The actor claims affiliates will receive full real-time visibility into every stage of the access they provide, including live attack monitoring, full reporting, and direct observation of ransom negotiations from first contact to final deal.
• ZeroFox has not independently confirmed whether nn0nn is associated with the n0n R&DE group. If related, this recruitment effort likely suggests n0n is attempting to scale its operations.

Nn0nn specifies the following requirements for the affiliate program:

• Target entities should have a minimum annual revenue of USD 10 million and be headquartered outside the Commonwealth of Independent States (CIS); the latter likely indicates close associations with the Russian-language cybercriminal ecosystem.
• Accepted access types include virtual private network (VPN), Remote Desktop Protocol (RDP), Remote Desktop Web Access (RDWeb), Secure Shell (SSH), botnets, and domain administrator credentials.
• The actor rejects user-level and local administrator accesses.
• Affiliates are required to work exclusively with the group and have no concurrent engagements with other operators in exchange for full attention and transparency from the group.

Nn0nn’s post on ReHub forum
Source: ZeroFox Intelligence

The actor is likely positioning the operation as a professionalized extortion syndicate and using operational transparency as a recruitment tactic to attract top-tier brokers who can provide domain administrator or root-level accesses.

• If the group succeeds in recruiting affiliates that meet its stated requirements, initial access processed through this program is likely to result in immediate, high-impact extortion activity.
• As of writing, ZeroFox noted replies to the post on ReHub are limited to neutral, procedural exchanges and do not indicate broker engagement, vetting, or pushback from the community.

ZeroFox noted two historical personas using the alias n0n: one active on Exploit in 2018 tied to botnet log monetization and bank log trading (later banned following a scam report) and another active on XSS in 2023 (banned for ransomware-related activity). We did not observe any connections between the nn0nn account and the two historical personas. If connected, this would very likely suggest an actor with a multi-year trajectory from botnet monetization to advertising a ransomware affiliate program.

TeamViewer Misconfiguration Available on Exploit

On October 25, 2026, untested threat actor “Exiles” advertised what they described as a “zero-day vulnerability” affecting the remote desktop software TeamViewer on the dark web forum Exploit. The actor offers the supposed vulnerability, which is very likely better described as a misconfiguration, for USD 15,000. Exiles stated they will only sell to a single buyer.

• TeamViewer is a Germany-based remote desktop and support software company and is the largest remote desktop provider in the world, with an estimated 50 percent market share.¹

The seller claims they have found a way to upload any file to a TeamViewer subdomain, render uploaded HTML files within a browser, and execute embedded cross-site scripting (XSS) payloads. This would allegedly result in executable files hosted on an attacker-controlled link, which would automatically download once a victim clicks the link.

Exiles’ original post on Exploit
Source: ZeroFox Intelligence

ZeroFox assesses that the core risk associated with this advertisement is very likely domain reputation abuse. A threat actor with the ability to post malicious links on a company website almost certainly presents a significant threat of reputational harm. Attack vectors for the alleged misconfiguration likely include high-fidelity phishing, malware delivery and spear phishing targeting high-value corporate targets, who will very likely trust a TeamViewer link.

The comparatively high price, along with the single buyer limitation, indicates the seller very likely believes this is a highly impactful, enterprise-grade exploit suitable for advanced persistent threats (APTs) or high-profile ransomware affiliates.

Unrestricted LLM Gaining Traction in Underground

On October 20, 2026, ZeroFox noted the emergence of an unrestricted large language model (LLM) service called “Dikaya”. The service, which has since gained traction on Telegram and the Exploit forum, advertises access to models with safety alignment and refusal mechanisms removed.

• ZeroFox assesses Dikaya’s operator to be moderately credible based on their limited activity on the Exploit forum.
• Dikaya’s offerings reportedly include GLM-5.3 and DeepSeek-V4.1 variants modified through “abliteration”—a technique that identifies the internal direction in a model associated with refusing requests and removes it from the model’s weights.
• Unlike jailbroken models, which depend on prompts that providers can patch, abliterated models have no refusal behavior left to bypass. Further, unlike custom models, they do not require resource-intensive retraining.
• As of writing, ZeroFox did not observe any pricing listed for the service.

Homepage of the Dikaya website
Source: ZeroFox Intelligence

The service is almost certainly dual-use. Security researchers will likely value an unrestricted model for red teaming and exploit research, but the same capability will almost certainly allow threat actors to generate working exploit code, malware, and other malicious tooling on request.

ZeroFox assesses that Dikaya is likely to lower the barrier to entry for less-skilled threat actors. Actors who previously could not write or adapt malicious code or were blocked by commercial LLM safeguards can now draft tooling, phishing content, and scripts quickly without crafting jailbreak prompts. More experienced actors are likely to use the service to shorten development cycles and iterate on existing tools.

• Removing refusals does not add capability. Output quality remains limited by the underlying models, and ZeroFox has not independently verified Dikaya’s claims or tested its output. Abliteration can also degrade model performance.
• Because the restrictions are removed from the weights, no provider-side safeguard can be tightened or revoked. A takedown of Dikaya would not remove the capability, as abliterated variants of open-weight models can be reproduced by any actor with the technical skills. ZeroFox assesses that similar services will likely emerge and compete in deep and dark web (DDW) communities.

Defenders should expect a rise in the volume and speed of tooling and lure development—particularly from lower-tier actors—rather than a new class of attack. Detection that relies on indicators of low-effort or unpolished content (such as poor phishing grammar or crude code) is likely to become less reliable. ZeroFox will continue to monitor Dikaya and similar services for evidence of operational use.

Recommendations

• Develop a comprehensive incident response strategy.
• Deploy a holistic patch management process, and ensure all IT assets are patched with the latest software updates as quickly as possible.
• Adopt a Zero-Trust cybersecurity architecture based upon a principle of least privilege.
• Implement network segmentation to separate resources by sensitivity and/or function.
• Ensure critical, proprietary, or sensitive data is always backed up to secure, off-site, or cloud servers at least once per year—and ideally more frequently.
• Implement secure password policies, phishing-resistant multi-factor authentication (MFA), and unique credentials.
• Configure email servers to block emails with malicious indicators, and deploy authentication protocols to prevent spoofed emails.
• Proactively monitor for compromised accounts and credentials being brokered in DDW forums.
• Leverage cyber threat intelligence to inform the detection of relevant cyber threats and associated tactics, techniques, and procedures (TTPs).

1. hXXps://technographics.6sense[.]com/remote-support/teamviewer-market-share ↩︎