DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

The operators of the DevMan ransomware-as-a-service (RaaS) scheme maintain a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage victim-related aspects. Swiss cybersecurity company PRODAFT tracks this centrally administered RaaS operation under the name Funky Mantis.

The portal combines build generation, finance, victim chat, support, victim records, teams, and payout functions. It integrates access brokerage with ransomware deployment, offering country-specific networks and imposing two-to-three-day completion windows. DevMan first emerged in April 2025 as an affiliate for Qilin, DragonForce, Apos, and RansomHub before shifting to its own RaaS operation. The locker’s DNA is unmistakably DragonForce, as noted by Vectra AI in October 2025.

In an interview with security researcher Jon DiMaggio, DevMan acknowledged working with Conti and claimed to have developed a specialized SCADA locker targeting an unnamed gas company, designed to inflict progressive physical damage beyond encryption. The Israel National Cyber Directorate (INCD) described the threat actor as having a high-profile online presence, often bragging about achievements and posting write-ups of attacks.

DevMan’s operations suffered a hit in June 2025 after a whistleblower named GangExposed doxxed operator identities, causing some affiliates to abandon the operation. According to Ransomware.Live, the group has claimed 184 victims, with no new victims reported after February 4, 2026. Nearly 50 victims are in the U.S., targeting technology, healthcare, financial services, professional services, and government sectors.

The affiliate portal, originally focused on builders, finance, victim chat, and help desk functions, received an upgrade to version 3 in January 2026, adding structured victim records, life cycle states, team creation, invitation controls, per-victim build options, deadline tracking, revenue fields, and shared operational access. PRODAFT identified five distinct roles within DevMan operations: LARVA-367 (administrator/owner), LARVA-546 (access coordinator), LARVA-547 (senior operator), LARVA-548 (senior operator/coordinator), and LARVA-550 (affiliate/operator).

Illicit proceeds follow an 80-20% split favoring affiliates. DevMan’s targeting policy allows strikes outside CIS countries and Serbia, excludes CIS consulates and CIS-linked companies, lifts a previous restriction on Saudi Arabia, encourages attacks against critical infrastructure, and instructs affiliates to request a separate encryptor for SCADA systems. The policy forbids attacks on child-related healthcare businesses and intentional leaks of personal data of individuals under 18.

The latest portal version allows affiliates to create lockers for Windows, ESXi, or Linux. The Windows locker includes functions for privilege checking, security-control impairment, process and service termination, recovery inhibition, event log clearing, local and network-share discovery, lateral movement, multi-threaded encryption, ransom-note creation, and optional self-deletion. It encrypts files with ChaCha20-Poly1305, fully encrypting files up to 3 MiB and partially encrypting larger files.

PRODAFT recommends organizations prohibit service and backup accounts from interactive VPN login, use phishing-resistant MFA for remote access and privileged administration, and rotate credentials exposed to VPN appliances, LDAP integrations, scripts, and backup tooling.

The disclosure also involves allegations that a Huntress employee passed communications from U.S. law enforcement to DevMan. Huntress CEO Kyle Hanslovan acknowledged the employee’s poor judgment but stated no evidence of illegal conduct was found. Former employee Ben Folland disagreed, calling the actions an insider threat.