DevMan ransomware is a locker that targets Windows, ESXi, and Linux systems. It uses ChaCha20-Poly1305 encryption, fully encrypting files up to 3 MiB and partially encrypting larger files. The Windows version includes functions for privilege checking, security-control impairment, process and service termination, recovery inhibition, event log clearing, discovery, lateral movement, multi-threaded encryption, ransom-note creation, and optional self-deletion. A specialized SCADA locker was developed for critical infrastructure attacks.