DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
DevMan RaaS portal centralizes payload builds, victim management, and affiliate payouts.
The DevMan ransomware-as-a-service (RaaS) operation utilizes a dedicated web platform for affiliates to build payloads, manage victims, and track earnings. PRODAFT is tracking this operation as Funky Mantis, noting its integration of access brokerage and ransomware deployment. DevMan, which has roots with other ransomware families like DragonForce, has claimed 184 victims, with a significant portion in the U.S. across various sectors.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Qilin?
Get an email when a new story names Qilin, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe DevMan ransomware-as-a-service operation demonstrates how cybercriminal groups have professionalized ransomware delivery by building dedicated platforms that lower the technical barrier for affiliates to launch attacks. By integrating access brokerage — the sale of pre-compromised network credentials — with payload building and victim management, the operation creates an end-to-end attack pipeline that accelerates time-to-impact. With 184 claimed victims primarily in the U.S., this model illustrates how RaaS ecosystems amplify the reach and frequency of ransomware incidents far beyond what a single threat actor could achieve. Organizations must treat ransomware not as a singular event but as a structured criminal supply chain requiring layered defensive responses.
