Devman is a financially motivated ransomware group that emerged in early 2025, initially operating as an affiliate for established ransomware operations such as Qilin, APOS, and DragonForce. Over time, the group evolved to deploy its own ransomware, also known as 'DevMan,' and by late 2025, launched DevMan 2.0 as a Ransomware-as-a-Service (RaaS) platform with an affiliate recruitment program. The group is distinguished by its aggressive double-extortion tactics and its high-profile online presence where it often publicizes its attacks and shares technical write-ups. A unique characteristic of Devman ransomware is a builder flaw that, in some instances, has led to the encryption of its own ransom notes, making them inaccessible to victims.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker