DevMan RaaS Operates Centralized Portal for Payload Builds and Victim Management

Centralized RaaS Operations

The DevMan ransomware-as-a-service (RaaS) scheme maintains a dedicated web platform that provides affiliates with tools for building payloads, overseeing earnings, and managing victim interactions. This operation is being tracked by the Swiss cybersecurity company PRODAFT under the name Funky Mantis.

Portal Functionality

The DevMan portal combines several critical functions, including build generation, finance management, victim chat, support, victim records, team coordination, and payout processing. It also integrates access brokerage with ransomware deployment, offering country-specific networks and imposing strict completion windows for affiliates.

DevMan's Evolution and Origins

DevMan first appeared in April 2025 as an affiliate for other RaaS groups like Qilin, DragonForce, Apos, and RansomHub, before establishing its own RaaS operation. Analysis by Vectra AI in October 2025 indicated that DevMan's ransomware shares a lineage with DragonForce, suggesting a common origin or shared code base.

Targeting and Public Presence

DevMan has claimed to have developed a specialized SCADA locker designed to target industrial control systems, aiming to inflict physical damage beyond data encryption. The group maintains a high-profile online presence, frequently posting updates and achievements in English and Russian, sometimes detailing their attack methodologies.

Operational Challenges and Victim Count

In June 2025, DevMan's operations faced disruption when a whistleblower, GangExposed, publicly revealed operator identities, leading some affiliates to leave the group. DevMan alleged that GangExposed attempted extortion. According to Ransomware.Live, DevMan has claimed 184 victims, with no new victims reported after February 4, 2026.