Devman / Devman 2.0
Parent: ransomhub| RaaS
Former RansomHub and INC Ransom affiliate.
Victims
184
First Discovered
2025-04-06
victim
Last Discovered
2026-02-04
victim
Inactive Since
97
days
Avg Delay
27.2
days
Infostealer
21.5%
victims with domain
Countries
39
hit
Attack Velocity — Last 12 months
Known Locations (3)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Devman's Place | No | 2026-04-28T07:23:36 |
qljmlmp4psnn3wqskkf3alqquatymo6hntficb4rhq5n76kuogcv7zyd.onion
|
|||
|
DEVMAN 2.0 - Leaked Data | No | 2026-04-28T07:26:11 |
wugurgyscp5rxpihef5vl6b6m5ont3b6sezhl7boboso2enib2k3q6qd.onion
|
|||
|
Devman Ransomware | No | 2026-04-28T07:28:43 |
devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onion
|
Target
Top 5 Activity Sectors
- Healthcare 28
- Technology 24
- Financial Services 16
- Public Sector 14
- Business Services 12
Top 5 Countries
-
United States
44
-
France
9
-
Svalbard and Jan Mayen
7
-
Taiwan, Province of China
7
-
Brazil
6
Heatmap
Ransom Notes (1)
TTPs Matrix (11)
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | PowerShell | Valid Accounts | Exploitation for Privilege Escalation | Masquerading | OS Credential Dumping | Remote System Discovery | SMB/Windows Admin Shares | Data from Local System | Exfiltration Over C2 Channel | Data Encrypted for Impact |
| Exploitation of Remote Services | Exploitation for Client Execution | Disable or Modify Tools | Network Service Scanning | Service Stop | ||||||
| System Information Discovery | Inhibit System Recovery | |||||||||
| Defacement |
YARA Rules (1)
Indicators of Compromise (IoCs) (5)
IP Address
3
tox
1
twitter
1
Victims (184)
The data contains materials of national security including BIO laboratory facilities blue prints, an…
[AI generated] TIW Group is a specialist software firm with over 30 years of experience in developin…
[AI generated] TWI Group is a specialized freight forwarder and logistics provider that primarily fo…
The data contains materials of national security including BIO laboratory facilities blue prints, an…
[AI generated] AutoMax.com is a leading used car dealership group in the US. Known for its wide rang…
[AI generated] Mims.com is an online resource for medical professionals used mainly in Asia-Pacific …
[AI generated] Consigaz is a Brazilian company that specializes in the distribution of Liquefied Pet…
data theft, evidence, officers personal information police reports, DEA open cases information…
Patients' full records, HIV test results, IDs.
Throughout a long waiting period, and despite a vast…
[AI generated] Hopital La Rabta is a major hospital located in Tunis, Tunisia. It provides a wide ar…
