Devman / Devman 2.0
| Active | RaaS
Former RansomHub and INC Ransom affiliate.
Victims
177
First Discovered
victim2025-04-06
Last Discovered
victim2026-01-27
Inactive Since
in day1
Avg Delay
between attack and claim30.4 days
Infostealer
for victim with domain21.4%
Known Locations (3)
Target (Available)
Top 5 Activity Sectors
- Technology 24
- Healthcare 18
- Public Sector 12
- Construction 7
- Agriculture and Food Production 6
Top 5 Countries
-
United States
31
-
France
9
-
Taiwan, Province of China
7
-
Svalbard and Jan Mayen
7
-
Thailand
6
Heatmap (Available)
Ransom Notes (1)
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (11)
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|
| Exploitation of Remote Services | PowerShell | Valid Accounts | Exploitation for Privilege Escalation | Masquerading | OS Credential Dumping | Remote System Discovery | SMB/Windows Admin Shares | Data from Local System | Exfiltration Over C2 Channel | Data Encrypted for Impact |
| Valid Accounts | Exploitation for Client Execution | Disable or Modify Tools | Network Service Scanning | Inhibit System Recovery | ||||||
| System Information Discovery | Service Stop | |||||||||
| Defacement |
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (5)
IP
3
TOX
1
TWITTER
1
| Type | IOC |
|---|---|
ip
|
83.217.209.210
|
ip
|
38.132.122.213
|
ip
|
38.132.122.214
|
tox
|
9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572FBD82F984981D
|
twitter
|
@Inifintyink
|
Victims (177)
twi-group.com
Devman
Discovery Date: 2026-01-27
[AI generated] TWI Group is a specialized freight forwarder and logistics provider that primarily fo...
c*n**lta**i*.com
Devman
Discovery Date: 2026-01-26
The data contains materials of national security including BIO laboratory facilities blue prints, an...
automax.com
Devman
Discovery Date: 2026-01-21
Estimated Attack Date: 2026-01-20
Estimated Attack Date: 2026-01-20
[AI generated] AutoMax.com is a leading used car dealership group in the US. Known for its wide rang...
www.mims.com
Devman
Discovery Date: 2026-01-21
[AI generated] Mims.com is an online resource for medical professionals used mainly in Asia-Pacific ...
consigaz.com.br
Devman
Discovery Date: 2026-01-12
Estimated Attack Date: 2026-01-11
Estimated Attack Date: 2026-01-11
[AI generated] Consigaz is a Brazilian company that specializes in the distribution of Liquefied Pet...
sealbeachca.gov
Devman
Discovery Date: 2026-01-12
Estimated Attack Date: 2026-01-11
Estimated Attack Date: 2026-01-11
Datatheft 300gb of data stollen includes gov documents, deeds and much more...
sealbeachpd.com
Devman
Discovery Date: 2026-01-12
Estimated Attack Date: 2026-01-11
Estimated Attack Date: 2026-01-11
data theft, evidence, officers personal information police reports, DEA open cases information...
******m*di*al.com
Devman
Discovery Date: 2026-01-12
Estimated Attack Date: 2026-01-11
Estimated Attack Date: 2026-01-11
Patients data, plastic operations data, SSNs...
Intonu.com
Devman
Discovery Date: 2025-12-28
Estimated Attack Date: 2025-12-25
Estimated Attack Date: 2025-12-25
Financial, Hr documents, claims...
oppor**nity*****.org
Devman
Discovery Date: 2025-12-28
Estimated Attack Date: 2025-12-27
Estimated Attack Date: 2025-12-27
Patients data, financial data...
Jennings SD
Devman
Discovery Date: 2025-12-28
Estimated Attack Date: 2025-12-27
Estimated Attack Date: 2025-12-27
Financial data, HR data...
Clínica Dávila
Devman
Discovery Date: 2025-12-22
Estimated Attack Date: 2025-12-18
Estimated Attack Date: 2025-12-18
Patients' full records, HIV test results, IDs.
Throughout a long waiting period, and despite a vast...
transrocamar.com
Devman
Discovery Date: 2025-12-22
Estimated Attack Date: 2025-12-19
Estimated Attack Date: 2025-12-19
Financial, Client IDS...
British Holiday & Home Parks Association Ltd
Devman
Discovery Date: 2025-12-22
Passport scans, Financial...
Culinary Jet Concierge
Devman
Discovery Date: 2025-12-19
Estimated Attack Date: 2025-12-17
Estimated Attack Date: 2025-12-17
[AI generated] N/A...
beausejourco-op.crs
Devman
Discovery Date: 2025-12-18
Estimated Attack Date: 2025-12-16
Estimated Attack Date: 2025-12-16
Financial, HR...
Axion50plus
Devman
Discovery Date: 2025-12-17
Estimated Attack Date: 2025-12-16
Estimated Attack Date: 2025-12-16
Financial, HR data, Client data...
Productos Lácteos Flor de Aragua CA
Devman
Discovery Date: 2025-12-16
Estimated Attack Date: 2025-12-10
Estimated Attack Date: 2025-12-10
HR data, clients data, Financial data...
DXS SYSTEMS
Devman
Discovery Date: 2025-12-15
Estimated Attack Date: 2025-12-14
Estimated Attack Date: 2025-12-14
[AI generated] N/A...
Quezon Power
Devman
Discovery Date: 2025-12-12
Estimated Attack Date: 2025-12-10
Estimated Attack Date: 2025-12-10
Employee data, hr info, projects, Work logs of the power plants, Scada SRC...
Hopital La Rabta
Devman
Discovery Date: 2025-12-12
Estimated Attack Date: 2025-12-11
Estimated Attack Date: 2025-12-11
[AI generated] Hopital La Rabta is a major hospital located in Tunis, Tunisia. It provides a wide ar...
Village Santé Saint Joseph Hospital
Devman
Discovery Date: 2025-12-09
Estimated Attack Date: 2025-12-06
Estimated Attack Date: 2025-12-06
patient data...
fassic.org
Devman
Discovery Date: 2025-12-09
Estimated Attack Date: 2025-12-06
Estimated Attack Date: 2025-12-06
Financial Records, Med cards, Hr documents...
Inter care
Devman
Discovery Date: 2025-12-09
Estimated Attack Date: 2025-12-08
Estimated Attack Date: 2025-12-08
Full quickbooks dump, patients data, and financial data...
hopital-*********.com
Devman
Discovery Date: 2025-12-07
Estimated Attack Date: 2025-12-06
Estimated Attack Date: 2025-12-06
Financial data, medical records...
f***i*.o*g
Devman
Discovery Date: 2025-12-07
Estimated Attack Date: 2025-12-06
Estimated Attack Date: 2025-12-06
Financial Records, Med cards, Hr documents...
S**** Saint ******
Devman
Discovery Date: 2025-12-07
Estimated Attack Date: 2025-12-06
Estimated Attack Date: 2025-12-06
Financial data, medical cards...
newhorizonsmedical.org
Devman
Discovery Date: 2025-12-01
Estimated Attack Date: 2023-06-07
Estimated Attack Date: 2023-06-07
Ransom: 90k
236gb...
promisedland.com.tw/h21 million USD...Time Remaining:---BUY Files
Devman
Discovery Date: 2025-09-15
1000000 USD...
