RAMP Uncovered: Anatomy of Russia’s Ransomware Marketplace

A leaked database from the RAMP dark web forum reveals the inner workings of Russia’s ransomware ecosystem, detailing 7,707 users and 340,000 IP records. The forum acted as a structured marketplace for selling access, recruiting affiliates, and advertising ransomware-as-a-service (RaaS) programs, with top targets including defense contractors, banks, hospitals, and government agencies.