Loading story…
US law enforcement seized the RAMP (Russian Anonymous Marketplace) cybercrime forum’s infrastructure, taking over both its Tor and clearnet presence and replacing them with a “This Site Has Been Seized” banner attributed to the FBI, coordinated with the US Attorney’s Office for the Southern District of Florida and the DOJ’s Computer Crime and Intellectual Property Section (CCIPS). RAMP was a key marketplace for ransomware-as-a-service (RaaS) promotion and related criminal services, including activity by extortionists and initial access brokers; the seizure banner also taunted operators with the forum’s slogan, “THE ONLY PLACE RANSOMWARE ALLOWED!,” alongside an image of Masha from the Russian children’s cartoon.
While authorities had not publicly detailed the operation at the time of reporting, technical indicators supported the takeover, including DNS changes consistent with prior FBI seizures (e.g., nameservers set to ns1.fbi.seized.gov / ns2.fbi.seized.gov). Reporting also cited an alleged operator (“Stallman”) acknowledging law enforcement control, and noted the seizure could expose forum user data (e.g., email addresses, IP addresses, and private messages), increasing identification and arrest risk for actors with poor OPSEC. Background context indicates RAMP emerged after other Russian-language forums restricted ransomware promotion under increased law-enforcement pressure.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Following the seizure, researchers assessed the takedown as a meaningful disruption but not a permanent blow to the cybercrime ecosystem. Reports indicated some actors, including Nova and DragonForce, were shifting activity toward other forums such as Rehub.
A user identified as 'Stallman,' described as an alleged RAMP operator or prospective owner, posted on XSS that law enforcement had seized the forum. The user said they would not rebuild RAMP but would continue buying network access.
WHOIS and DNS changes on RAMP's clearnet domain showed an update on January 28, with nameservers changed to ns1.fbi.seized.gov and ns2.fbi.seized.gov. These technical changes corroborated that the domain had been taken over through a standard U.S. seizure process.
U.S. law enforcement seized the RAMP cybercrime forum's clearnet domain and Tor site, replacing them with an FBI seizure notice. The action was attributed to the FBI in coordination with the U.S. Attorney’s Office for the Southern District of Florida and the DOJ’s Computer Crime and Intellectual Property Section.
RAMP emerged in July 2021 as a Russian-language cybercrime forum and marketplace after Exploit and XSS banned ransomware promotion under increased law-enforcement pressure following the Colonial Pipeline incident. The platform became a venue for ransomware operators, affiliates, brokers, and malware sellers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcedatabreaches.net
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. law enforcement has **seized the RAMP cybercrime forum**, a long-running hub used to advertise and facilitate ransomware operations, malware distribution, and other illicit services. Both the forum’s Tor presence and clearnet domain (reported as `ramp4u[.]io`) were replaced with an FBI seizure banner indicating coordination with the U.S. Attorney’s Office for the Southern District of Florida and the DOJ’s Computer Crime and Intellectual Property Section; the forum’s administrator reportedly acknowledged the takedown publicly on the XSS forum. Reporting notes RAMP emerged as a dedicated venue for ransomware promotion after other major forums restricted such activity, and that criminal communities are already attempting to migrate to alternative platforms. Separate reporting also highlighted other cybercrime enforcement actions (including indictments tied to **Ploutus**-based ATM jackpotting and other marketplace disruptions), but those are distinct from the RAMP seizure. A different, unrelated incident involved a **supply-chain compromise of eScan antivirus** update infrastructure in which attackers briefly pushed a backdoor via a trojanized `Reload.exe` that altered update settings, established persistence via a scheduled task, and contacted a C2 to retrieve additional payloads; this event is not connected to the RAMP takedown and should be tracked independently as a vendor update-channel compromise affecting customer environments.
Jun 29, 2026
A leaked MySQL database from the **RAMP** cybercrime forum has exposed the inner workings of a major Russia-linked ransomware marketplace, while separate reporting says the **FBI later seized the forum**. Analysis of the leak showed RAMP operated from November 2021 through January 2024 as a commercial hub for the full ransomware supply chain, connecting initial access brokers, ransomware-as-a-service (**RaaS**) operators, and affiliates through public listings and private negotiations. The dataset reportedly contained **7,707 users**, **1,732 threads**, **340,333 IP log records**, **1,899 private conversations**, and **3,875 private messages**, revealing **333 access-sale threads** and **60 RaaS threads**. Listings targeted organizations in more than 20 countries, with the **United States** appearing in about **40%** of identifiable offers, and victims spanning government, banking, healthcare, energy, technology, defense, and telecommunications. The records showed affiliates could receive up to **90%** of ransom proceeds, underscoring how ransomware campaigns were sustained by a specialized underground market built around stolen access, affiliate recruitment, and private deal-making.
Jun 29, 2026
US and international law enforcement continued disrupting illicit online marketplaces and forums used to trade **ransomware services, malware, stolen data, and drugs**. The FBI seized the dark web and clear web domains for **RAMP**, a long-running, predominantly Russian-language cybercrime forum that marketed itself as the “only place ransomware allowed,” and which hosted vetted users, tutorials, and a marketplace for malware and criminal services; the seizure was coordinated with the US Attorney’s Office for the Southern District of Florida and DOJ’s Computer Crime and Intellectual Property Section. Separately, US prosecutors announced guilty pleas tied to major darknet markets that also sold **cybercrime tools and stolen information** alongside narcotics. A Virginia man, **Raheim Hamilton** (aka `Sydney`/`ZeroAngel`), co-creator of **Empire Market**, pleaded guilty to federal drug conspiracy charges related to facilitating roughly **$430M** in transactions (2018–2020) and designing the market to evade law enforcement using cryptocurrency. A Slovakian national, **Alan Bill** (aka `Vend0r`/`KingdomOfficial`), pleaded guilty for helping operate **Kingdom Market** (2021–2023), which authorities previously seized in December 2023; investigators linked him to the operation after his arrest with devices and a crypto hardware wallet allegedly containing evidence tying him to the marketplace.
Jun 29, 2026