logo

Interview #6 Devman

ID: aea49a7d-e590-5eae-971c-af7e8835ece9

STIX ID: report--aea49a7d-e590-5eae-971c-af7e8835ece9

Feed Name: deepdarkCTI

Threat Score
78/100

Date Published: 2025-07-15

Date Updated: 2026-06-07

Author: Erez

...
...

This interview presents a first-person account from the operator of 'Devman', a ransomware-as-a-service. The operator describes rapid development (rewriting in Rust for performance and obfuscation), an affiliate revenue model with strict vetting, a focus on high-value targets (including critical infrastructure and healthcare), ties and code/infrastructure links to other RaaS groups (DragonForce), and operational practices such as a custom compiler and anti-analysis tactics. The content demonstrates active criminal capability, targeting intent, and organizational structure of a ransomware group.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.