Cyber Threat Actor: RAMP

The threat actor known bythe alias RAMP has been observed operating from Russia. In June 2023 the actor posted an advertisement on a Russian‑language forum offering access to a military satellite owned by Maxar Technologies. The asking price for the satellite access was fifteen thousand dollars. The same post also claimed availability of AT&T corporate email accounts. The actor indicated that an escrow service would be used to facilitate the transaction. The claims made in the advertisement have not been independently verified.

The advertised targets span the defense sector, via the Maxar satellite, and the telecommunications sector, via AT&T’s internal email. By highlighting the possibility of revealing United States military and strategic positioning information, the post implied a potential intelligence value. Simultaneously, the offer of corporate email access points to a concern for confidential business communications. The framing of the sale as a financial transaction suggests a primary motive of monetary gain rather than overt political or disruptive aims. No technical details such as malware families, initial‑access vectors, or specific tooling were disclosed in the public report. Consequently, the actor’s tactics, techniques, and procedures remain unspecified beyond the use of a forum and escrow arrangement.

Attribution of the RAMP alias to any state‑sponsored group or known criminal consortium has not been established in open sources. The actor’s location is only inferred from the language of the forum and the contextual hint of Russia, without concrete evidence. The June 2023 incident represents the sole publicly documented operation associated with RAMP. It illustrates how underground markets can be leveraged to broker access to high‑value assets such as satellite systems and corporate networks. Until further reporting emerges, the profile of RAMP remains limited to the observed advertisement and its associated claims.