RAMP—the predominantly Russian-language online bazaar that billed itself because the “only place ransomware allowed”—had its dark web and clear web pages seized by the FBI because the agency tries to combat the growing scourge threatening critical infrastructure and organizations around the globe.
Visits to each sites on Wednesday returned pages that said the FBI had taken control of the RAMP domains, which mirrored one another. RAMP has been among the many dwindling variety of online crime forums to operate with impunity, following the takedown of other forums akin to XSS, which saw its leader arrested last 12 months by Europol. The vacuum left RAMP as certainly one of the leading places for people pushing ransomware and other online threats to purchase, sell, or trade services.
I regret to tell you
“The Federal Bureau of Investigation has seized RAMP,” a banner carrying the seals of the FBI and the Justice Department said. “This motion has been taken in coordination with the US Attorney’s Office for the Southern District of Florida and the Computer Crime and Mental Property Section of the Department of Justice.” The banner included a graphic that appeared on the RAMP site, before it was seized, that billed itself because the “only place ransomware allowed.”
Screenshot
RAMP was founded in 2012 and rebranded in 2021, in line with security firm Rapid 7. The platform served Russian, Chinese, and English speakers and counted greater than 14,000 registered users, who underwent strict vetting before being accepted or paid a $500 fee for anonymous participation. The forum provided discussion groups, cyberattack tutorials, and a marketplace for malware and services. Its chief administrator said in 2024 the location earned $250,000 annually.
