DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

DevMan (tracked by PRODAFT as Funky Mantis) is a sophisticated RaaS operation providing affiliates a full-featured portal to generate and manage multi-platform ransomware (Windows/ESXi/Linux) that uses ChaCha20-Poly1305 encryption, supports lifecycle and team management, enforces affiliate governance and revenue splits, and has claimed ~184 victims including critical sectors; analysts also report a specialized SCADA locker designed to inflict progressive physical damage, and the disclosure includes allegations that a security firm employee shared FBI communications with the group.