ZeroFox

ShinyHunters has been running a systematic campaign against the education sector since late 2024, and the recent Canvas breach shows exactly how it works.

The group uses credentials stolen from one institution to breach the next, climbing a ladder of escalation that has now reached a platform used by thousands of institutions and millions of people.

Our latest Flash Report breaks down the tactics, the methodology, and what comes next. Read the full report: https://ow.ly/jB4050Z1c5i

Discover. Validate. Disrupt.

That’s how ZeroFox approaches cyber threat intelligence. Gartner® recognized us as a Leader in the Magic Quadrant™ for Cyberthreat Intelligence Technologies. See the full evaluation and find out why we were recognized.

Download the report: https://ow.ly/Y9wi50YZH38

We’re heading to InfoSec Europe next month! Join ZeroFox at Booth C128 and catch Adam Darrah on the Deep Dive Stage for a session on the realities of the deep and dark web.

🎤 Demystifying the Dark Web
📅 Wednesday, 3 June
🕑 14:10 - 14:55
📍Deep Dive Stage

If you’ll be at the event, stop by and see us at Booth C128 or book a time here: https://ow.ly/qQEU50YZGZo

ZeroFox Threat Intelligence is back with the latest edition of the Underground Economist.
This issue covers:

🗂️ ShinyHunters allegedly disclosing nearly one million DarkForums user records after exploiting a myBB vulnerability
🏢 Publicly exposed building access control systems reportedly accessible through default credentials
🤖 A new AI-based hacking tool advertised as an all-in-one platform for fraud, malware development, and intrusion support
🔐 A new version of the ShadowByt3$ ransomware-as-a-service platform with upgraded evasion and persistence features

Get the latest from the deep and dark web in the the Underground Economist: https://ow.ly/jP5250YW7PI

ZeroFox has been named a Leader in the Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies.

At ZeroFox, we believe this placement reflects a shift in how enterprises approach external cybersecurity, one that moves beyond monitoring and alerting toward platforms that can discover exposure, validate risk, and actively disrupt adversaries.

Read the full announcement and stay tuned for complimentary access to the report: https://ow.ly/4LgB50YVCi8

Retail companies’ business needs naturally lead to a broad external attack surface.

E-commerce platforms, supplier portals, third-party connections, spoofed domains, counterfeit operations, and forgotten assets all create openings that traditional perimeter-based security was never built to manage.

Our latest blog explores how EASM helps retailers identify those exposures earlier and strengthen protection before threats disrupt business and erode trust: https://ow.ly/7OiW50YOf3F

Security conversations are moving beyond the endpoint.

In a recent piece from ChannelPro Network, ZeroFox’s Mark Stevens shares why digital risk protection is becoming a bigger part of the MSSP opportunity, especially as threats grow more targeted and more external.

Read the full coverage: https://ow.ly/In4E50YOeWb

Security teams shouldn’t be the last to know when a threat pattern is already taking shape.

From civil unrest and organized crime activity to severe weather and infrastructure threats, the risks most likely to affect operations often build well before an incident occurs.

Our latest blog looks at how our PSI Regional Forecasts help security teams plan ahead with monthly, region-specific threat intelligence delivered directly in the ZeroFox platform.

Read more: https://ow.ly/xJcF50YOeUU

Ransomware activity did not cool off in Q1. It stayed near record highs.

ZeroFox observed at least 2,059 ransomware and digital extortion incidents in Q1 2026, with March alone accounting for 747 incidents. Manufacturing remained the most targeted industry, and North America continued to face the highest concentration of attacks.

Our latest Q1 Ransomware Wrap Up breaks down the regional trends, top targeted sectors, and the most active collectives shaping the ransomware landscape.

Read the full wrap up: https://ow.ly/K6B650YNCip

We’ve expanded our partnership with e92plus to bring external threat protection to their network of MSSP partners across the UK, Ireland, and Benelux.

Most managed security programs are built around the internal network. That leaves a growing gap: Brand fraud, impersonation attacks, phishing infrastructure, and executive targeting that traditional tools don't reach.

Through this partnership, e92plus partners can now add fully managed external threat protection to their stack, without complexity.

Read the full announcement: https://ow.ly/YgQe50YMQrA