DevMan
A ransomware operation that emerged in April 2025 as an affiliate of other groups, then built its own programme on a locker closely related to DragonForce. PRODAFT reported in July 2026 that the operation had stopped, and assessed with moderate confidence that the person behind it now works as an affiliate elsewhere.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
DevMan is best understood through code reuse. ANY.RUN found a sample largely based on DragonForce, which itself derives from Conti, with a copied ransom note and a flawed build.3 Vectra warns that this reflects continuity of code and does not prove continuity of people.4
PRODAFT's July 2026 research describes an affiliate portal covering payload builds, victim records, chat and payouts, with a third version in January 2026 and an 80 to 20 revenue split.1 PRODAFT found no solid evidence explaining why the operation stopped. It assesses with moderate confidence that the individual is still active as an affiliate of other groups.1
Intel 471 reports a strong presence in Asia, with further targeting in Africa and Europe, and describes small and mid-sized firms as high risk.2 The operators' rules encouraged attacks on critical infrastructure and they claimed an encryptor for SCADA systems, but that claim is the actor's own.1 The sources cited do not establish a UK link.
A brand going quiet does not retire the person or the methods. Since PRODAFT assesses that the actor remains active under other programmes, we would keep defending against the behaviour rather than the name.
How It Attacks
Based on Intel 471's overview2 and PRODAFT's analysis of the Windows locker as reported.1
- 1
Get In
Uses compromised credentials, exposed remote services or other footholds. Vectra cites VPN exploitation in early attacks.
- 2
Find What Matters
Searches for high-value systems, shares and backups.
- 3
Escalate
Gains privileges before deploying the locker.
- 4
Weaken Defences
Impairs security controls, stops processes and services, inhibits recovery and clears event logs.
- 5
Spread and Encrypt
Discovers local and network shares, moves laterally and encrypts files.
- 6
Extort
Steals data before encryption and threatens to publish it.
Key Techniques
ATT&CK v20 has no group entry for DevMan. These are from Intel 471's mapping.2
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement | Moves across admin shares. |
| T1021.006 | Windows Remote Management | Lateral Movement | Uses WinRM for remote access. |
| T1047 | Windows Management Instrumentation | Execution | Runs commands through WMI. |
| T1569.002 | Service Execution | Execution | Runs payloads as services. |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence | Uses autostart locations. |
| T1555 | Credentials from Password Stores | Credential Access | Takes credentials from password stores. |
| T1074.001 | Local Data Staging | Collection | Stages data locally. |
Vulnerabilities
We found no source that clearly ties a specific CVE to a DevMan intrusion. Vectra mentions VPN exploitation without naming one.4
Defences That Matter
Protect Remote Access
- Require MFA on remote services and review exposed accounts, as these are the reported routes.2
Keep Backups Out of Reach
- Separate backups from domain credentials, as operators look for them.2
Defend Against the Behaviour
- Monitor SMB, WinRM and WMI for unusual movement.2
- Track behaviours rather than brand names, given the reuse of code.
Are You Defending Against Names or Behaviours?
We can test your detection against the behaviours in this profile and help you close the gaps.
Sources
- The Hacker News: DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts, 25 July 2026
- Intel 471: DevMan Ransomware, Emerging Threats report, 21 January 2026
- ANY.RUN: DEVMAN Ransomware: Analysis of New DragonForce Variant, 1 July 2025
- Vectra AI: From Conti to Black Basta to DevMan: The Endless Ransomware Rebrand, 17 October 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.