RAMP is a Russian-language dark web forum known for serving as a central marketplace in the RaaS ecosystem.
RAMP was a Russian-speaking dark web forum founded in 2021, serving as a central marketplace and recruitment hub for ransomware operators, affiliates, and initial access brokers — the backbone of the RaaS ecosystem rather than a ransomware group itself. It primarily facilitated targeting of organizations across finance, healthcare, and technology sectors by connecting cybercriminals with access and tools. Key TTPs/tools revolved around trading ransomware strains like LockBit and BlackMatter, sharing initial access obtained via phishing and vulnerability exploitation, and coordinating C2 infrastructure through the forum. Defenders should focus on monitoring initial access vectors such as RDP and VPN vulnerabilities, tracking indicators of compromise (IOCs) shared on RAMP-like platforms, and reinforcing targeted phishing awareness training for employees.
RAMP (Russian Anonymous Marketplace) was a Russian-speaking dark web forum founded in 2021 that served as a central marketplace and recruitment hub for ransomware operators, affiliates, and initial access brokers — not a ransomware group itself but the backbone of the RaaS ecosystem; it was seized by the FBI in January 2026.
RAMP was a Russian-speaking dark web forum founded in 2021, serving as a central marketplace and recruitment hub for ransomware operators, affiliates, and initial access brokers, rather than a ransomware group itself.
Ransomware strains like LockBit and BlackMatter were traded through the RAMP forum.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.