Devman / Devman 2.0
| active
Former RansomHub and INC Ransom affiliate.
Victims
64
First Discovered
victim2025-04-06
Last Discovered
victim2025-08-04
Inactive Since
in day(s)16
Avg Delay
between attack and claim15 days
Infostealer
for victim with domain34.6%
Known Locations (2)
Target (Available)
Top 5 Activity Sectors
- Technology 12
- Construction 5
- Public Sector 5
- Healthcare 4
- Consumer Services 2
Top 5 Countries
-
Thailand
6
-
South Africa
6
-
Taiwan, Province of China
5
-
Japan
5
-
Singapore
4
Heatmap (Available)
Ransom Notes (0)
No ransom notes available.
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (4)
IP
3
TOX
1
| Type | IOC |
|---|---|
ip
|
83.217.209.210
|
ip
|
38.132.122.213
|
ip
|
38.132.122.214
|
tox
|
9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572FBD82F984981D
|
Victims (64)
NSSF KENYA /nssf.zip - first samle /nssfwriteup.html - writeup
Devman
Discovery Date: 2025-06-07
4.5 million USD...
