Inside RAMP: What a leaked database reveals about Russia’s ransomware marketplace

RAMP (Russian Anonymous Marketplace) was a Russian-language cybercrime forum that operated from late 2021 until it was seized by the FBI on January 28, 2026, in coordination with the U.S. Attorney’s Office for the Southern District of Florida. It ran as both a Tor hidden service and maintained a clearnet mirror at ramp4u.io, making it more accessible than many competing forums.

The forum ran on XenForo 2.2.5, a commercial platform, and had dedicated sections for selling network access, malware, ransomware partnerships, stolen data, and hiring criminal freelancers. Thread titles appeared in Russian, English, and Chinese, highlighting its global audience from Western cybercriminals to East Asian threat actors.

Comparitech gained exclusive access to a leaked database from RAMP. The full MySQL dump contains user records, forum threads, private messages, IP logs, and admin activity spanning November 2021 through January 2024.

RAMP at a glance

• 7,707 registered users
• 1,732 forum threads
• 340,333 IP log records
• 1,899 private conversations
• 3,875 private messages
• 14 RaaS programs advertised
• 250+ ransomware leak sites referenced

Key findings:

• The RAMP forum facilitated sale of corporate network access to organizations including defense contractors, energy companies, banks, hospitals, and government agencies across 20+ countries
• The US is the #1 target: it appeared in 40% of listings where a country was identified
• A single access broker posted 41 separate listings selling entry points into corporate networks, including a US company with $1.2 billion in revenue and government networks in South America and Ukraine
• 14 ransomware-as-a-service (RaaS) programs actively recruited affiliates, offering up to 90% of ransom payments
• Government agencies were the most-targeted sector (21 listings), followed by finance/banking and technology/telecom (11 each)
• Forum activity surged 348% from a low of 67 threads in Q4 2022 to 300 threads in Q4 2023, suggesting a major resurgence after law enforcement disruptions

The access market: selling the keys to corporate networks

The single largest section of RAMP was its access marketplace, where 333 threads offered entry points into compromised corporate networks. These listings represent the first stage of the ransomware kill chain — before any malware is deployed, someone has to get inside.

Access types sold

The most common access type was RDP (Remote Desktop Protocol), appearing in 59 listings, followed by VPN access (22) and SSH/shell access (22). Domain Administrator access (giving full network control) was advertised in 12 listings and commands a premium.

Target countries

The United States dominates the victim list, appearing in 40% of listings where a country was identified:

Target industries

Government organizations were the most frequently targeted sector:

Named organizations in thread titles included a PEPSI official distributor in Asia ($250M+ revenue), an Indian defense aerospace company, Toyota’s Brazilian operations ($1B+ revenue), the Consolidated Bank of Ghana, AddisBank (Ethiopia), Emirates Telecom ($1.3B revenue), a Mexican embassy, hospitals in South Korea and Thailand, China Telecom, and Israeli telecommunications infrastructure.

The shift toward VPN exploitation

In early 2022, the market was dominated by RDP access. By late 2023, VPN access listings had grown significantly, reflecting a shift in attack methodology:

*Data ends late January.

VPN access listings jumped from near-zero throughout 2022 to 7 in Q4 2023, matching RDP. This correlates with the surge of critical Cisco, Fortinet, and Citrix VPN vulnerabilities disclosed in 2023, which criminals rapidly weaponized.

SSH access, virtually absent in 2022, appeared in nine listings during Q2-Q3 2023 — mostly from sellers “xss_0x2” (12 SSH listings total) and “dayone31337_blardo” (4 SSH listings for Chinese and Korean targets).

Which VPN vendors are criminals targeting?

When sellers specified the VPN product they had compromised, Cisco appeared most frequently:

One seller (“blackod”) posted five consecutive Cisco VPN access listings for US, Australian, Canadian, and UK organizations in November 2023 alone, suggesting automated scanning and exploitation of a common Cisco vulnerability at scale. Another thread explicitly referenced CVE-2019-11510 (Pulse Secure) by name, demonstrating that known but unpatched vulnerabilities remain a primary entry point.

A separate demand-side thread from “yakuza” titled “Buy corporate access [SonicWall, Cisco, Fortinet, F5 BIG IP, Pulse, Citrix, RDWeb]” further confirms that these seven vendors represent the primary targets.

The biggest listings by victim revenue

Access to a South Korean conglomerate with a reported annual revenue of $16 billion was the most valuable listing on the forum:

The bigger the target, the higher the price

Of the 333 access listings, 48 explicitly stated the victim organization’s annual revenue. Buyers use this info to approximate how much money they could steal or extort from victim organizations, which in turn determines the price of access.

The ransomware economy: affiliate splits reaching 90%

RAMP hosted 60 threads in its dedicated RaaS section, where ransomware operators recruit affiliates. The data reveals a clear trend toward more generous splits over time — from 80/20 in early 2022 to 90/10 by mid-2023:

A 90/10 split means the person deploying the ransomware keeps $900,000 out of every $1 million in ransom collected. This escalation reflects fierce competition for skilled and willing affiliates across the cybercrime ecosystem.

14 RaaS programs advertised on RAMP (2021–2024)

We identified 14 distinct RaaS programs:

• AvosLocker (Nov 2021)
• Conti (Nov 2021)
• Luna (Jun 2022)
• BEAST (Jun 2022)
• Nevada (Dec 2022)
• CryptNet (Apr 2023)
• Knight 3.0 (May 2023)
• NoEscape (May 2023)
• Bl00dy (Jul 2023)
• KUIPER (Sep 2023)
• UBUD (Nov 2023)
• PHOBOS — cracked builder (Dec 2023)
• Zeppelin2 — source code leak (Dec 2023)
• Wing 1.0 (Jan 2024)

The appearance of cracked builders and leaked source code (PHOBOS, Zeppelin2) is particularly concerning. It lowers the barrier to entry, allowing anyone to launch independent ransomware attacks outside the RaaS model entirely. No affiliate agreement, no profit-sharing, and no operator oversight are required.

Democratization through cracked builders

Seven separate listings offered cracked or leaked versions of established ransomware and penetration testing tools:

The LockBit 3.0 builder leak was the most consequential. LockBit was the world’s most prolific ransomware operation when RAMP was at its peak, and its leaked builder has been used by dozens of independent operators who have no affiliation with the original group. This single leak multiplied the number of LockBit-branded attacks far beyond what the original operators could manage.

Cracked versions of commercial penetration testing tools like Cobalt Strike ($5,900/year) and Core Impact ($20,000+/year) further lower barriers. These tools, designed for legitimate security testing, provide professional-grade attack capabilities at zero cost to criminals.

The combined effect is a “democratization” of ransomware — the tools, techniques, and playbooks that once required affiliation with a major RaaS operation are now freely available to any moderately skilled criminal.

The malware supermarket

The malware marketplace hosted 121 listings across a range of criminal tools:

Standout listing: a crypto-stealing botnet advertised at $25,000 that claimed to bypass two-factor authentication on major cryptocurrency exchanges. The forum also listed a VPN RCE 0-day exploit with an asking price of $100,000, indicating that nation-state-grade vulnerabilities circulate in these spaces.

The criminal job market: $25K/month for malware developers

RAMP’s freelance section (68 threads) functions as a criminal career marketplace.

Only one thread explicitly advertised a salary, but it was a striking one. A user posting under “OttoFonBismark” in November 2022 offered $20,000–$25,000 per month for an Android “virologist” (malware developer), promising “fast and big money.”

The compensation spectrum

The top 10 vendors on RAMP

The most active sellers represent the forum’s commercial backbone:

“RobinHood” stands out as a dual-role threat actor: selling corporate access to targets including an Indian defense aerospace firm and a PEPSI distributor, while simultaneously operating the KUIPER RaaS program targeting Windows, Linux, ESXi, NAS, MacOS, and FreeBSD.

The demand side: who’s buying?

Twenty-four threads were posted by buyers actively seeking corporate access, revealing what’s in demand:

The AvosLocker listing is particularly significant: a known ransomware operation directly posting buying requests on the same forum where it advertised its RaaS program. This confirms the supply chain relationship between access brokers and ransomware operators.

The request for SCADA access from Iran and road camera access in a specific country suggest state-aligned or espionage-motivated activity alongside the primarily financially-motivated listings.

Several buyers offered profit-sharing arrangements (“pay % from profit”), indicating that some buyers lack the upfront capital to purchase access outright and instead offer a cut of eventual ransom payments.

Forum growth: a U-shaped recovery

RAMP’s activity follows a distinctive pattern. After a strong 2021 launch, activity declined through 2022, hitting a low of just 67 threads in Q4. Then it rebounded sharply through 2023:

*Data ends late January.

The Q4 2022 trough likely reflects law enforcement operations that year, including the Hive ransomware takedown and related arrests. The 2023 resurgence, peaking at 300 threads in Q4, suggests the forum successfully attracted displaced users from other disrupted platforms.

Operational security: where criminals slip up

Most RAMP users relied on privacy-focused email providers. Proton Mail accounted for 38% of registrations.

A significant minority made poor choices. Across the full 7,707 user database, 94 accounts were registered with Gmail addresses tied to Google accounts. Several contain patterns consistent with real names.

The forum’s server logged 340,333 IP records across 4,788 users. While most IPs are Tor exit nodes (expected for a .onion site), the data provides session correlation and timing analysis opportunities. We identified connections from residential ISPs in multiple countries, suggesting some users accessed the forum without Tor protection.

Private messages: the deals behind the curtain

The database includes 1,899 private conversations containing 3,875 messages — the hidden negotiations that turn forum listings into actual attacks. Conversation subjects include “VPN access,” “Stealer,” “Request [RaaS] Private Partner Program,” and direct deal-making. This private message data captures the actual transaction layer that public forum posts only advertise.

For example, when the forum’s most prolific access broker “inthematrix” listed access to a South Korean conglomerate with $16 billion in annual revenue, buyer inquiries arrived within hours. One user (“frenkie378”) initiated a private conversation titled “South Korea / 16kkk/ local admin” that ran to three replies, showing a complete negotiation cycle from listing to deal. In total, inthematrix’s 41 public access listings generated 41 private conversations with buyers including ransomware operators, access resellers, and pentest teams.

Methodology

This analysis is based on a MySQL database dump of the RAMP forum’s XenForo installation. We parsed raw SQL to extract structured data from the xf_user (7,707 records), xf_thread (1,732 records), xf_post, xf_ip (340,333 records), xf_admin_log, xf_conversation_master (1,899 records), and xf_conversation_message (3,875 records) tables. IP addresses were decoded from binary format and geolocated against known ISP allocations. All findings are based on data as it existed in the database dump and have not been independently verified against live sources.