Published in



Author: Hotsauce | S2W TALON


  • Ransomware operators and affiliate programs were banned from major forums on the Darkweb.
  • As the last resort for ransomware operators and affiliates to work begins to disappear, the RAMP forum is born.
  • According to a post by the RAMP operator, it was created “to protect against fraudulent RaaS and ransomware partner job advertisements on deep web and dark web forums”, which were banned after the incident of Colonial Pipeline.


(Ref. W4 July | EN | Story of the week: Ransomware on the Darkweb | by S2W LAB | S2W LAB BLOG | Jul, 2021 | Medium)

  • As mentioned in the 4th week post in July, RAMP is a site that has been changed from Payload.bin to a membership forum.
  • The forum also sold FortiNet VPN and shared hacking tools used in the infiltration process.
  • LockBit affiliate program promotion article became an issue and it became known a lot.

2. Face-off (Private Forum > Private Market + Forum)

(Ref. [SoW] W5 July | EN | Story of the week: Ransomware on the Darkweb | by S2W LAB | S2W LAB BLOG | Jul, 2021 | Medium)

  • Due to a spam posting incident in the forum, the new member registration was abruptly stopped and the forum was closed.
  • After closing, it was mentioned that in the future, only users who have been active in the hacking forum for a certain amount or more will be accepted as a condition for membership registration.
  • RAMP, which is currently open, operates a market as well as a forum.
    In the market, they organize the product of Accesses / DB / Logs, SPAM / Traffic, Servers, Carding, Work, Etc.

3. The condition of Registration

  • RAMP has added conditions so that only users with a history of activities in the DDW forum can sign up for membership.
  • Among the membership conditions of RAMP, the most important conditions for membership are as follows.

The condition of Registration (EN)

4. The current status of RAMP

  • Currently, RAMP is on the 2 days ~ 3 days of activation, and there are not many posts.
  • Someone is recruiting for a job, chatting with morning greetings.


  • The newly reorganized RAMP forum operates not only general community bulletin boards, but also bulletin boards for sales such as Access and DB.
  • RAMP operates the market and community exist at the same time, and it is expected that many users will gather because it also serves as a bot market.



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store

S2W is specializing in cybersecurity data analysis for cyber threat intelligence.