RAMP
Attribution profile
- Type
- Hacker
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2023-06-21
- Last seen
- 2023-06-21
- Updated
- 2026-10-15 09:34
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known as RAMP, operating from Russia, gained public attention in June 2023 when it advertised on a Russian‑language forum the sale of access to a Maxar Technologies military satellite for $15,000 and also offered access to AT&T corporate email accounts, noting the use of an escrow service to facilitate the transaction. The actor’s activity appears financially motivated, targeting the defense and telecommunications sectors by offering unauthorized access to sensitive assets; no specific malware, initial‑access vectors, or tooling were described in the reporting. Public sources have not linked RAMP to any state sponsor or criminal consortium, and its location in Russia is the only attribution detail provided. The June 2023 forum post advertising the satellite and email access represents the actor’s sole publicly reported operation to date.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.