[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQFRdKdaxO-Wz5KRmPd-IboxDHug0tuENHkYnfk9y7CU":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":66},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4899d35f-86f8-408a-930c-ccf415bec868","DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts","devman-raas-portal-centralizes-payload-builds-victim-management-and-affiliate-pa-6fdd85","The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administered RaaS operation under the name Funky Mantis. \"The portal combined build generation, finance,","The DevMan ransomware-as-a-service (RaaS) operation utilizes a dedicated web platform for affiliates to build payloads, manage victims, and track earnings. PRODAFT is tracking this operation as Funky Mantis, noting its integration of access brokerage and ransomware deployment. DevMan, which has roots with other ransomware families like DragonForce, has claimed 184 victims, with a significant portion in the U.S. across various sectors.","DevMan RaaS portal centralizes payload builds, victim management, and affiliate payouts.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fdevman-raas-portal-centralizes-payload.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiCfK-jqRTN8rgDTTIOMahlXeGbBvgMLQqdUc4pcB1eXYGmbMfvzVLohoakIuE6nlS9k2G8ncIMwgaYcfLN1r90Obxd8IDHGo5UVz-iDNkBaEbzcDMJl5yzaCQ7VTSh5GFOy8O6CjHXvK7Sdo0WctNPRFBxxtWONllByeJ1EtphQ-sDRabRefeNuXxzdCzY\u002Fs1600\u002Fransomware-hacker.jpg","2026-07-25T09:53:41+00:00","2026-07-25T12:00:10.833393+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"DevMan","threat_actor",{"name":21,"type":22},"Funky Mantis","campaign",{"name":24,"type":25},"Qilin","product",{"name":27,"type":25},"DragonForce",{"name":29,"type":25},"Apos",{"name":31,"type":25},"RansomHub","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24,27,29],{"controls":58,"vendors":59},[],[60],{"slug":61,"name":62,"logo_path":63,"roles":64},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png",[65],"reported_by",{"slug":67,"title":68,"body":69,"framework_refs":70,"framework_notes":85},"devman-raas-platform-industrializes-ransomware-operations-for-affiliates","DevMan RaaS Platform Industrializes Ransomware Operations for Affiliates","The DevMan ransomware-as-a-service operation demonstrates how cybercriminal groups have professionalized ransomware delivery by building dedicated platforms that lower the technical barrier for affiliates to launch attacks. By integrating access brokerage — the sale of pre-compromised network credentials — with payload building and victim management, the operation creates an end-to-end attack pipeline that accelerates time-to-impact. With 184 claimed victims primarily in the U.S., this model illustrates how RaaS ecosystems amplify the reach and frequency of ransomware incidents far beyond what a single threat actor could achieve. Organizations must treat ransomware not as a singular event but as a structured criminal supply chain requiring layered defensive responses.",[71,72,73,74,75,76,77,78,79,80,81,82,83,84],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 5 – Account Management","CIS Control 11 – Data Recovery","CIS Control 13 – Network Monitoring and Defense","NIST CSF ID.RA-1 – Asset Vulnerabilities Identified","NIST CSF RS.RP-1 – Response Plan Executed","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","MITRE ATT&CK T1486 – Data Encrypted for Impact","MITRE ATT&CK T1583.006 – Acquire Infrastructure: Web Services","GDPR Article 32 – Security of Processing","ITIL Service Continuity Management",{}]