ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - July 13, 2026

Product Serial: D-2026-07-13a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed in deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple extortion groups posted new leak-site entries, including Everest, Anubis, M3RX, and CRPx0.
Vulnerability Disclosures: An authentication-bypass vulnerability was disclosed in the Gitea Docker image (CVE-2026-20896).
Hacktivism: Pro-Palestinian group Dark Storm Team claimed a DDoS attack (via their Telegram channel) against the New York City Police Department's public transparency portal (nypdonline[.]org).
Emerging Extortion Infrastructure: A new data leak site, "D1R," was observed listing three alleged targets.
Data Dissemination and Telemetry: Forums and leak sites hosted several breach and data-sale claims, including alleged data tied to Mobilemed advertised and cross-posted to a threat actor's DLS (Kazu) and multiple credential datasets totaling hundreds of thousands of records. Separately, credential intelligence systems ingested over 1.7 billion combined compromised account (CAC) and botnet records between June 15 and July 12, 2026.