FBI seizes RAMP cybercrime forum used by ransomware gangs

https://www.bleepingcomputer.com/news/security/fbi-seizes-ramp-cybercrime-forum-used-by-ransomware-gangs/

Publish Date: 2026-01-28 12:38:00

The FBI has seized the notorious RAMP cybercrime forum, a platform used to advertise a wide range of malware and hacking services, and one of the few remaining forums that openly allowed the promotion of ransomware operations.

Both the forum’s Tor site and its clearnet domain, ramp4u[.]io, now display a seizure notice stating, “The Federal Bureau of Investigation has seized RAMP.”

“This action has been taken in coordination with the United States Attorney’s Office for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice,” the notice reads.

RAMP seizure banner

The seizure banner also appears to taunt the forum’s operators by displaying RAMP’s own slogan: “THE ONLY PLACE RANSOMWARE ALLOWED!,” followed by a winking Masha from the popular Russian “Masha and the Bear” kid’s cartoon.

While there has been no official announcement by law enforcement regarding this seizure, the domain name servers have now been switched to those used by the FBI when seizing domains:

Name Server: ns1.fbi.seized.gov
Name Server: ns2.fbi.seized.gov

If so, law enforcement now has access to a significant amount of data tied to the forum’s users, including email addresses, IP addresses, private messages, and other potentially incriminating information.

For threat actors who failed to follow proper operational security (opsec), this could lead to identification and arrests.

In a forum post to the XSS hacking forum, one of the alleged former RAMP operators known as “Stallman” confirmed the seizure.

“I regret to inform you that law enforcement has seized control of the Ramp forum,” reads the translated forum post.

“This event has destroyed years of my work building the freest forum in the world, and while I hoped this day would never come, I always knew in my heart it was possible. It’s a risk we all take.

Forum operator confirming seizure of RAMP