U.S. authorities have seized the notorious Russian Anonymous Marketplace (RAMP), effectively shutting down one of the last major platforms where ransomware and cybercrime services were openly advertised. As of January 28, 2026, both the forum’s Tor and clearnet domains display a seizure notice confirming that the FBI has gained control, with domain nameservers updated to those used by law enforcement. While the FBI has not officially commented, the technical details confirm the platform’s takedown.
A Major Loss for Cybercriminals
RAMP, launched in 2021, had become a central hub for ransomware-as-a-service operations, malware developers, and initial access brokers. It was one of the few forums where ransomware could still be openly promoted, a situation that changed after rising pressure from law enforcement on other major platforms. The forum’s creation by a figure known as “Orange,” who had been part of the Babuk ransomware group, attracted significant traffic from cybercriminals looking to buy and sell malicious services and recruit affiliates. Despite its rocky start, including DDoS attacks, RAMP gained notoriety as a reliable marketplace for illicit activities, particularly ransomware.
Stallman Confirms Shutdown
In an underground forum post, a user known as “Stallman,” believed to be one of RAMP’s operators, confirmed the forum’s seizure, expressing regret over the loss of what he called "the freest forum in the world." Stallman acknowledged that while the takedown was always a risk, it was a blow to years of work. His post, a rare moment of vulnerability in the cybercrime world, signals the end of an era for RAMP, although Stallman indicated that the forum’s closure would not stop him from continuing his activities in other spaces.
What Happens to the Data?
The FBI’s control of RAMP means that valuable data from its users—such as email addresses, IPs, private messages, and more—is now potentially in their hands. For those who failed to maintain strong operational security, this could lead to identification and arrests. Cybercriminals have long operated with the knowledge that their actions carry risks, but this takedown highlights the consequences of those risks.
Despite the disruption, experts warn that such takedowns rarely end cybercrime operations; instead, they force criminal networks to adapt. RAMP’s users will likely scatter to other underground spaces, many of which are in the process of being developed right now.
Being in the Crosshairs
Looking back, Kai West’s arrest in 2025 for selling stolen data illustrated the growing interest authorities have had in dark web platforms like Ramp for some time. West’s mistake of accepting a Bitcoin payment led investigators to trace his identity and uncover a network of illicit transactions. His capture serves as a reminder that law enforcement has been closely monitoring these platforms, with operations spanning multiple years, and the takedown of forums like RAMP being part of a broader operations.
RAMP’s Legacy and Future
RAMP was a key part of the evolution of cybercrime infrastructure, but its closure does not spell the end of ransomware or other cybercriminal activities. The platform’s focus on ransomware-as-a-service made it a unique and vital resource for those in the business of network intrusion and digital extortion. While some of its operators, including Mikhail Matveev (the alleged mastermind behind RAMP), remain high-profile targets for law enforcement, the criminal ecosystem continues to adapt quickly.
With the takedown, the cybercrime underground will likely see a temporary disruption, but new forums and marketplaces will soon rise to take RAMP's place. The landscape of online crime is constantly shifting, and while law enforcement efforts like this one may slow down certain operations, they rarely eliminate the infrastructure that fuels them. As always, those involved in these activities must remain vigilant, but they will undoubtedly continue to evolve and rebuild in response to these constant threats.
Conclusion
The seizure of RAMP is a significant blow to cybercrime, but it’s far from the end. While no arrests have been made yet, the data now in the FBI’s possession could lead to prosecutions in the future. As history shows, the takedown of one platform doesn’t end the criminal ecosystem; instead, it pushes cybercriminals to quickly adapt and find new spaces to operate. Just like the myth of Hydra, where cutting off one head leads to five more growing in its place, the darknet continues to evolve, with opportunists already rushing in to fill the void left by RAMP. Despite law enforcement’s ongoing efforts, the underworld remains resilient, constantly shifting and reconstituting itself.
0 Comments