Devman / Devman 2.0
| Active | RaaS
Former RansomHub and INC Ransom affiliate.
Victims
67
First Discovered
victim2025-04-06
Last Discovered
victim2025-09-06
Inactive Since
in day(s)7
Avg Delay
between attack and claim15 days
Infostealer
for victim with domain39.3%
Known Locations (2)
Target (Available)
Top 5 Activity Sectors
- Technology 12
- Construction 5
- Public Sector 5
- Healthcare 4
- Manufacturing 2
Top 5 Countries
-
Taiwan, Province of China
6
-
Thailand
6
-
South Africa
6
-
Japan
5
-
Singapore
4
Heatmap (Available)
Ransom Notes (0)
No ransom notes available.
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (11)
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|
| Exploitation of Remote Services | PowerShell | Valid Accounts | Exploitation for Privilege Escalation | Masquerading | OS Credential Dumping | Remote System Discovery | SMB/Windows Admin Shares | Data from Local System | Exfiltration Over C2 Channel | Data Encrypted for Impact |
| Valid Accounts | Exploitation for Client Execution | Disable or Modify Tools | Network Service Scanning | Inhibit System Recovery | ||||||
| System Information Discovery | Service Stop | |||||||||
| Defacement |
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (5)
IP
3
TOX
1
TWITTER
1
| Type | IOC |
|---|---|
ip
|
83.217.209.210
|
ip
|
38.132.122.213
|
ip
|
38.132.122.214
|
tox
|
9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572FBD82F984981D
|
twitter
|
@Inifintyink
|
Victims (67)
NSSF KENYA /nssf.zip - first samle /nssfwriteup.html - writeup
Devman
Discovery Date: 2025-06-07
4.5 million USD...
