DevMan Turned Extortion Into SaaS: A Single Portal for Affiliates

The operators of the DevMan extortion scheme, which runs on a ransomware-as-a-service model, maintain a full-fledged web portal that has turned cyber extortion into something resembling a corporate service. The Swiss company PRODAFT, which tracks the group under the name Funky Mantis, has described the platform in a detailed report.

According to the researchers, the portal brings together payload generation, finances, victim chat, support, victim accounts, team building and payouts. The service combines initial-access brokering with ransomware deployment: administrators offer affiliates “networks” by country, clarify whether the affiliate's own access or a provided one will be used, and set hard deadlines — two or three days to complete an attack.

From affiliation to their own brand

DevMan emerged in April 2025 as an affiliate of Qilin, DragonForce, Apos and RansomHub, and then launched its own operation. According to Vectra AI, the ransomware's “genetics” point unambiguously to DragonForce. In an interview with researcher Jon DiMaggio, the attacker admitted to collaborating with Conti and boasted of developing a specialized “SCADA locker” for a gas company — the malware was supposedly meant to push industrial systems beyond their operating parameters, driving equipment to overheat and fail physically.

In June 2025 the group was hit by an anonymous figure using the handle GangExposed, who revealed the operators' identities; some affiliates left afterward. DevMan claims that the same person tried to extort between 0.3 and 1 BTC from them. The group has 184 victims to its name, about 50 of them in the US; no new attacks have been recorded after February 4, 2026.

Bureaucracy instead of chats

The v3 version of the portal, released in January 2026, added structured victim cards, lifecycle states, team creation, invitation control and deadline tracking. PRODAFT identified five roles — from the owner-administrator down to the rank-and-file operator — and described a strict hierarchy: a newcomer is added to the corporate chat only after their first victim and is assigned a mentor, and without results within a month they can be expelled. Profits are split 80/20 in the affiliate's favor.

The targeting policy prohibits attacks on CIS countries and Serbia, but explicitly encourages strikes on critical infrastructure and mandates requesting a separate ransomware build for SCADA systems. Off-limits are children's medical facilities and leaks of minors' data. The lockers are built for Windows, ESXi and Linux, with encryption carried out using the ChaCha20-Poly1305 algorithm.

An insider at Huntress

The publication coincided with a scandal surrounding the company Huntress. Former employee Ben Folland accused a firm analyst of forwarding FBI inquiries to DevMan, including screenshots with agents' names. Huntress CEO Kyle Hanslovan called this “questionable long-term contacts” and “shortsightedness,” noting that no evidence of illegal activity had been found. Folland disagrees with the characterization: in his words, it is a classic insider threat — no different from a bank employee tipping off a fraudster about a police investigation.

Source: The Hacker News