Description Summary
Former RansomHub and INC Ransom affiliate.
Threat Actor
Former affiliate of DragonForce, Qilin, RansomHub and Apos; now independent RaaS.
Technical Indicators
Encryption Extension
.devman
Encryption Algorithm
DragonForce-builder variant (Conti-inherited crypto, incl. its flaws); DevMan 2.0 in Rust
Ransom Note Name
Not publicly reported
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
April 2025 (affiliate) → DevMan 2.0 RaaS Sept 2025
Last Seen
Active
Geographical Location
Global / not publicly profiled
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |