Loading story…
The Russian-speaking cybercrime forum XSS banned all ransomware-related topics, including affiliate program advertisements, ransomware rentals, and sales of ransomware software. The forum’s administrator said ransomware had brought excessive publicity and law-enforcement attention to the site, with scrutiny intensifying after the DarkSide attack on Colonial Pipeline. Researchers cited in the reports said XSS had been one of the main underground venues used by ransomware groups to recruit affiliates and promote ransomware-as-a-service operations.
The move drew negative reactions from representatives linked to REvil and LockBit, underscoring how important major forums were to the ransomware ecosystem. A day later, Exploit, another major Russian-language cybercrime forum, reportedly imposed a similar ban on ransomware advertisements. The back-to-back restrictions suggested that pressure from high-profile attacks, political fallout, and increased law-enforcement focus was forcing prominent underground platforms to distance themselves from overt ransomware promotion.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
In early 2020, the Cracked and Nulled forums banned Zoom-related content associated with Zoom-bombing activity. The article presents this as another precedent for forum administrators removing topics that attract unwanted attention.
In 2016, HackForums banned advertisements for DDoS-for-hire services after Mirai source code was published and amid FBI scrutiny of Mirai-related attacks. The article cites this as a prior example of cybercrime forums restricting risky content under law-enforcement pressure.
One day after XSS announced its restriction, the Exploit forum also banned ransomware advertisements. With Exploit's move, both of the two major hacking forums hosting ransomware ads had prohibited such promotions.
Representatives of the REvil and LockBit ransomware operations expressed displeasure after XSS posted its ransomware ban. Their reactions underscored XSS's importance as a recruiting and advertising venue for ransomware groups.
The Russian-speaking hacking forum XSS announced a ban on ransomware-promoting topics, including affiliate program ads, ransomware rentals, and sales of ransomware software. The administrator said ransomware had become too dangerous, noisy, and attention-grabbing for the forum.
DarkSide carried out a ransomware attack that encrypted Colonial Pipeline's network and disrupted the fuel pipeline's operations. The incident is described as a major trigger for heightened scrutiny of ransomware forums and actors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware groups are increasingly operating like structured criminal businesses, outsourcing key functions to specialists and launching formal affiliate programs across underground forums. Researchers and reporting describe growing demand for **initial access brokers** and dedicated **negotiators** who handle ransom talks, pressure tactics, and extortion messaging, while forums such as **RAMP** emerged to support ransomware recruitment after other Russian-speaking sites restricted such advertising. New and revived operations have continued to market themselves aggressively, including **Eclipse Ransomware** with a managed affiliate model, Tor-based negotiation portals, leak-site support, and revenue-sharing terms, as well as earlier examples such as REvil-linked infrastructure reappearing to recruit affiliates and Maze partnering with other gangs through shared leak platforms.
Aug 15, 2026
US law enforcement seized the **RAMP (Russian Anonymous Marketplace)** cybercrime forum’s infrastructure, taking over both its Tor and clearnet presence and replacing them with a “This Site Has Been Seized” banner attributed to the **FBI**, coordinated with the **US Attorney’s Office for the Southern District of Florida** and the DOJ’s **Computer Crime and Intellectual Property Section (CCIPS)**. RAMP was a key marketplace for **ransomware-as-a-service (RaaS)** promotion and related criminal services, including activity by extortionists and **initial access brokers**; the seizure banner also taunted operators with the forum’s slogan, “**THE ONLY PLACE RANSOMWARE ALLOWED!**,” alongside an image of *Masha* from the Russian children’s cartoon. While authorities had not publicly detailed the operation at the time of reporting, technical indicators supported the takeover, including DNS changes consistent with prior FBI seizures (e.g., nameservers set to `ns1.fbi.seized.gov` / `ns2.fbi.seized.gov`). Reporting also cited an alleged operator (“**Stallman**”) acknowledging law enforcement control, and noted the seizure could expose forum user data (e.g., email addresses, IP addresses, and private messages), increasing identification and arrest risk for actors with poor OPSEC. Background context indicates RAMP emerged after other Russian-language forums restricted ransomware promotion under increased law-enforcement pressure.
Jun 29, 2026
U.S. law enforcement has **seized the RAMP cybercrime forum**, a long-running hub used to advertise and facilitate ransomware operations, malware distribution, and other illicit services. Both the forum’s Tor presence and clearnet domain (reported as `ramp4u[.]io`) were replaced with an FBI seizure banner indicating coordination with the U.S. Attorney’s Office for the Southern District of Florida and the DOJ’s Computer Crime and Intellectual Property Section; the forum’s administrator reportedly acknowledged the takedown publicly on the XSS forum. Reporting notes RAMP emerged as a dedicated venue for ransomware promotion after other major forums restricted such activity, and that criminal communities are already attempting to migrate to alternative platforms. Separate reporting also highlighted other cybercrime enforcement actions (including indictments tied to **Ploutus**-based ATM jackpotting and other marketplace disruptions), but those are distinct from the RAMP seizure. A different, unrelated incident involved a **supply-chain compromise of eScan antivirus** update infrastructure in which attackers briefly pushed a backdoor via a trojanized `Reload.exe` that altered update settings, established persistence via a scheduled task, and contacted a C2 to retrieve additional payloads; this event is not connected to the RAMP takedown and should be tracked independently as a vendor update-channel compromise affecting customer environments.
Jun 29, 2026