DevMan RaaS Operation: Centralized Portal and Affiliate Management
DevMan is a ransomware-as-a-service (RaaS) operation that emerged in April 2025, initially as an affiliate for Qilin, DragonForce, Apos, and RansomHub before…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Funky Mantis: PRODAFT’s Tracking Name for DevMan RaaS
Funky Mantis is the name assigned by Swiss cybersecurity company PRODAFT to track the DevMan ransomware-as-a-service operation. The group operates a centralized…
Cl0p Affiliates Exploit PTC Windchill and FlexPLM Flaws in Data Extortion Campaign
Threat actors linked to the Cl0p ransomware group are actively exploiting vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments as part of…
Chubby Scorpius — Attack group profile
Chubby Scorpius was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
FIN11 — Attack group profile
FIN11 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Graceful Spider — Attack group profile
Graceful Spider was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Lace Tempest — Attack group profile
Lace Tempest was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate…
ClickFake Interview: North Korea-Aligned Threat Cluster
ClickFake Interview is a threat cluster tracked by Sekoia, associated with North Korea-aligned actors. It uses ClickFix-like lures to deceive targets into…
Golden Chickens MaaS Ecosystem Resurfaces
Golden Chickens, also tracked as Venom Spider and TAG-195, is a financially motivated malware-as-a-service developer. It has resurfaced with four new malware…