Two ransomware crews announced forum partnerships after the RAMP seizure: Vect on 25 March and The Gentlemen on 16 May. Vect promised an affiliate key to every forum member; The Gentlemen invited teams, pentesters and access brokers as an official forum partner. A separate 13 June commentary item describes a forum deposit without establishing which forum issued the rule.
BleepingComputer reported an FBI seizure banner on RAMP on 28 January 2026. We looked at where the ransomware recruitment posts in our data appeared after that date.
This piece is part of the Brandefense Cybercrime Report 2026. The wider picture, 9,203 de-duplicated leak-site claims from 177 groups, is in the ransomware chapter. The timing below is our observation, not proof that the seizure caused any of it.
- 2Forum partnerships 52 days apart, 25 March and 16 MaySource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt
- 19 of 25Vect claims that fell in February, the month of its v2 adSource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt
- Keys vs invitationsThe partnerships describe different ways to distribute a programmeSource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt
- 0.5 BTCDeposit described in anonymous commentary about one forum; the forum identity and policy are not verifiedSource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt
What the RAMP Forum Was and What Happened on 28 January
RAMP launched in July 2021 after the Exploit and XSS forums banned ransomware promotion. Its slogan said it was the only place where ransomware was allowed. Crews used it to promote ransomware operations openly. On 28 January 2026 BleepingComputer reported that the Tor site and the clearnet domain showed an FBI seizure banner, with no official announcement and no comment from the FBI.
Blackhole holds almost nothing from RAMP, XSS or Exploit, so we cannot see what RAMP carried before it closed. We can see the posts that appeared in the places Blackhole does cover: a handful of forums and a large set of Telegram channels. That is the view this piece describes.
The Twelve Recruitment Items by Venue
The 14 January item is the only retained recruitment item before the reported 28 January seizure. Its Russian-language forum description requires Russian-speaking participation and offers call and mailing services. This selected inventory does not establish all recruitment activity before the seizure.
The other eleven retained items are listed below. Dates are the catalogue’s first observations; programmes can appear in more than one venue.
| First seen | Crew | Venue and language | Stated terms |
|---|---|---|---|
| 31 Jan | Unnamed insider offer (forum signature) | English forum | The retained description does not say who would receive any percentage; excluded from the share comparison |
| 1 Feb | Mimic | Russian forum | Notice to partners |
| 14 Feb | Vect v2 | English forum | Seeks pentesters, access specialists, affiliates |
| 11 Apr | Gunra | English forum (EN/RU/ZH) | 85% to affiliate, 15% operator fee |
| 22 Apr | Nova 2.0 | Russian forum | 75%, rising with tenure and volume to 90% after a year and 95% above 1M revenue (currency not stated) |
| 15 May | The Gentlemen | English forum | 90% to affiliate |
| 17 May | KRYBIT | Russian forum | Hiring pentest teams |
| 1 Jun | KittyKatKrew | English Telegram | 90% to affiliate, $200 stub |
| 1 Jul | CRPX0 | English Telegram | 70% commission, negotiation team |
| 24 Jul | Firestorm | Russian forum | Locker for bought corporate access |
| 7 Oct | FLOCKER | English forum | 90% to affiliate, $170 invitation fee |
The first Telegram recruitment ad we found is dated 1 June. Splits and fees are what the sellers say, and the ransomware chapter compares them in detail.
One caution on the count: the seizure fell in the first month of our window, so almost any ad we found would come after it. The number 11 of 12 shows where recruitment was visible to us, not that it moved.
Forum Rules Are Also Advertised Claims
The edited catalogue describes: Overview of which Russian-language forums allow ransomware ads: one new rule with 0.5 BTC deposit, one bans in words only, one on and off
Advertised terms as catalogued: 0.5 BTC deposit.
This item is an anonymous commentary account of forum policy, not a verified rule issued by that forum. Its 0.5 BTC deposit has a named denomination, but the catalogue cannot establish that anyone paid it or that the stated policy operated. We do not infer migration from the claim.
Two Crews Announced Forum Partnerships 52 Days Apart
The two partnerships describe different distribution designs. The 14 February Vect item advertises a v2 builder and recruits pentesters, access specialists and triple-extortion affiliates.
On 25 March Vect announced a partnership with an English-language leak forum and with the group behind the LiteLLM supply chain compromise. The catalogue item promises each forum member an affiliate key and deployment help, and records an April statement that keys had been sent. These are distribution promises, not a verified count of enrolled affiliates or successful deployments.
| Group | Jan | Feb | Mar | Apr | May to Oct | Total |
|---|---|---|---|---|---|---|
| Vect | 2 | 19 | 2 | 2 | 0 | 25 |
| The Gentlemen | 48 | 91 | 50 | 85 | 738 (peak 159 in August) | 1,012 |
The table counts leak-site claims we linked to each group by month. Vect had 19 of its 25 claims in February, the month of its v2 ad. March and April each had two claims, and none were observed from May onward. Monthly totals cannot separate the days before and after the 25 March partnership.
The Gentlemen’s claims were already high in January and rose to 159 in August. The sequence is all we can report.
The Gentlemen followed with a recruitment ad on 15 May and an official partnership announcement with the same forum on 16 May, 52 days after Vect. Its item invites teams, pentesters and access brokers; Vect’s promises keys to every member. This is a difference in what is offered to the audience, without a count of actual affiliates.
A third form of forum tie-in appears on 13 April. A Russian-language channel posted that a partner programme sponsored a ransomware forum’s article contest. No amount is given.
Why the Sequence Does Not Measure Migration
The catalogue places the two forum partnership announcements after the reported seizure. It also contains recruitment descriptions from forums and Telegram. It does not contain comparable samples of the seized venue before and after its closure. A temporal sequence alone cannot show where recruitment moved or whether its volume changed.
The group-by-month table answers a narrower question. Vect already had 19 claims in February and no observed claims after April; The Gentlemen already had substantial claims before its May recruitment. Those sequences do not establish an effect of either partnership.
What Defenders Can Do With This
A seizure removes one address. Our data cannot show whether demand changed, so plan around programmes and brand names, not one forum. Our guide to hacker and leak forums explains how these venues work, and the entry on ransomware as a service covers the model.
- Track the programme, not the forumCrews in our data advertised on forums and on Telegram in the same year, so one venue gives an incomplete picture.
- Read ads for the target profileGunra excludes CIS countries, Firestorm advertises a built-in CIS check, and Nova lists places not to attack. Use the terms in your threat model.
- Watch for access salesSeveral posts ask for corporate access. See how initial access broker listings look.
- Plan the talks before the note arrivesSome programmes sell the chat itself. Our piece on negotiation as a service covers it.
Brandefense follows these claims through ransomware intelligence, so you can be told when a listing names your organization.
Evidence and Scope
This article uses the edited 60-item ransomware catalogue and the collected relay series for 1 January–27 October 2026. Catalogue dates are first-seen dates.
The selection is not a market census; programme descriptions, advertised terms and claims are different evidence units. The catalogue is an attributed account, not a fresh authentication of every original. October is partial and 22–28 July is sampled.
A claim is one canonical group–victim pair. The 9,203-claim series excludes 190 0APT claims and removes 171 spelling-variant duplicates. A repeated relay post is not independent confirmation. Asking terms do not establish payments, delivery or tested effectiveness.
AI-Assisted Preparation
Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
