DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

Portal Overview

The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administered RaaS operation under the name Funky Mantis.

"The portal combined build generation, finance, victim chat, support, victim records, teams, and payout functions," the company said in an extensive report shared with The Hacker News. "The service integrated access brokerage or access distribution with ransomware deployment. Administrators offered country-specific 'networks,' asked whether an affiliate would use personal or program-supplied access, and imposed two-to-three-day completion windows."

Origins and Lineage

Various analyses show that DevMan first emerged on the scene in April 2025 as an affiliate for Qilin, DragonForce, Apos, and RansomHub, before shifting to their own RaaS operation. The locker's DNA is "unmistakably DragonForce," Vectra AI noted back in October 2025, highlighting the ransomware's shared lineage.

In an interview with security researcher Jon DiMaggio published in October 2025, DevMan acknowledged that they worked with Conti and claimed they had developed a "specialized SCADA locker" to target an unnamed gas company that was designed to inflict progressive physical damage beyond encryption. Per the threat actor, the malware would "push industrial control systems beyond their operating parameters, processors, memory, and thermal limits, forcing systems to ramp up and run hot until hardware failed."

"The threat actor is operating with a high-profile online presence and updating about developments, updates and general statements mainly in English and sometimes in Russian as well," the Israel National Cyber Directorate (INCD) said in a bulletin released last year. "They often 'brag' about their achievements, to the point where they post write-ups that describe the way they gained access and performed the attack."

Operational History and Victim Statistics

DevMan's operations suffered a hit in June 2025 after a mysterious whistleblower calling themselves GangExposed publicly doxxed operator identities, causing a few affiliates to abandon the operation. DevMan also alleged that GangExposed attempted to extort them for 0.3 to 1 Bitcoin during their Telegram interactions.

According to statistics on Ransomware.Live, the group has claimed 184 victims to date, with no new victims reported after February 4, 2026. Nearly 50 victims are located in the U.S., with technology, healthcare, financial services, professional services, and government sectors accounting for the most targeted.

Portal Evolution and v3 Upgrade

The affiliate portal associated with the operation, which originally revolved around builders, finance, victim chat, and help desk functions, has since received an upgrade. The third version ("v3") of the platform released in January 2026 comes with support for structured victim records, life cycle states, team creation, invitation controls, per-victim build options, deadline tracking, revenue fields, and shared operational access.

"This progression indicates an effort to formalize affiliate workflows and manage multiple intrusions through a common platform rather than relying only on chat-based coordination," PRODAFT said.

Roles and Governance

The cybersecurity company has identified five distinct roles within the DevMan operations:

• LARVA-367 - Administrator/owner and central coordinator
• LARVA-546 - Access coordinator named as an alternative point of contact for network access
• LARVA-547 - Senior operator
• LARVA-548 - Senior operator or coordinator
• LARVA-550 - Affiliate/operator who was credited for an installation in an actor-controlled group message

"Affiliates were added to corporate chat after producing a first victim and were assigned an experienced curator," PRODAFT said. "They could be removed after one month without a new victim. Team formation and disclosure of program affiliation required curator approval, which limited independent coordination and public association with the service."

The core management also reserves the right to take over a conversation if an affiliate behaves inappropriately or fails to adhere to a commitment. The governance model reduces affiliate autonomy, while giving the administrators the power to enforce operational tempo and protect their revenue.

Payment Splits and Targeting Policy

The illicit proceeds obtained after successful extortion follow an 80-20% split, allowing the affiliate to earn a chunk of the profits. The v3 platform rules state that the ransom funds are sent to two wallets, one for the affiliate and one linked to the RaaS program.

DevMan's stated targeting policy allows affiliates to strike entities outside the CIS countries and Serbia. It also excludes CIS consulates and CIS-linked companies, and lifts a previous restriction on Saudi Arabia. Besides explicitly encouraging attacks against critical infrastructure, it instructs affiliates to request a separate encryptor for SCADA systems, corroborating their development on a specialized SCADA locker. However, the policy forbids affiliates from attacking child-related healthcare businesses and intentional leaks of personal data belonging to people under the age of 18.

Technical Details of the Locker

The latest version of the portal allows affiliates to create a locker for Windows, ESXi, or Linux. An analysis of the Windows version has identified functions related to privilege checking to determine if it's running as an administrator, security-control impairment, process and service termination, recovery inhibition, event log clearing, local and network-share discovery, lateral movement, multi-threaded encryption, ransom-note creation, and optional self-deletion.

The locker encrypts files with ChaCha20-Poly1305. Files up to and including 3 MiB are fully encrypted, while those above the threshold are partially encrypted by processing a 1 MiB chunk every 51 MiB.

"Organizations should prohibit service and backup accounts from interactive VPN login unless a documented operational requirement exists," PRODAFT said. "Remote access and privileged administration should use phishing-resistant MFA. Teams should rotate credentials exposed to VPN appliances, LDAP integrations, scripts, and backup tooling, with priority given to secrets that can grant local or domain administrative access."

Insider Threat Allegations at Huntress

The disclosure also comes at a time when Ben Folland, a former employee of security firm Huntress, accused another analyst of passing communications from U.S. law enforcement to DevMan. The incident is said to have taken place in December 2025.

In a subsequent blog post, Huntress CEO Kyle Hanslovan said the company is aware of "questionable, long-term threat actor communications" between a threat researcher who is still employed with the security firm and a cybercriminal, calling it "poor judgement."

"In one particular exchange, our current teammate disclosed to a threat actor that law enforcement had reached out to them about the threat actor," Hanslovan said. "While this disclosure was not illegal, it reflected poor judgment."

"As a result of the investigation, my team implemented more robust policies for our researchers, coached teammates on engaging with threat actors, and took appropriate administrative actions. While we haven't found evidence of illegal conduct, insider activity, or additional disclosures, we are continuing our investigation."

Folland, however, has disagreed with the assessment, stating that the employee's actions "meet the definition of an insider threat." The ex-Huntress employee also questioned Huntress if the analyst was permitted to engage with DevMan to "support active investigations."

Per Folland, the U.S. Federal Bureau of Investigation (FBI) is said to have contacted the Huntress employee to gather intelligence on DevMan. "She immediately forwarded the exact FBI communications to the threat actor, including screenshots containing FBI agent names," Folland said. "She informed DevMan that law enforcement was actively looking into him. She also refused to cooperate because they wanted DevMan."

"This was not just 'poor judgment,'" Folland continued. "This was a Huntress employee taking sensitive knowledge about a law enforcement approach and passing it directly to the person being investigated. If someone inside a bank warns a fraudster that police are investigating them, nobody would describe that as merely 'poor judgment.' They would call it what it is - an insider."