RAMP Forum Seizure Fractures Ransomware Ecosystem

Rapid7 analysis and reporting describe how the FBI-led seizure of the RAMP ransomware forum has driven fragmentation of the ransomware underground: closed, paid-entry forums like T1erOne and open alternatives like Rehub are emerging as hosts for RaaS offerings, with known groups (LockBit, Gentlemen, DragonForce, Qilin, Cry0) advertising services. The shift reduces defenders' centralized visibility, increases reliance on referral-based recruitment, and follows a partial leak of RAMP's database — indicating continued, organized ransomware activity despite disruption.