ransomware

Devman

dormantAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

DevManDevman's PlaceDevman 2.0Devman2

Attribution

Devman is the persona/handle of a single ransomware operator who emerged in 2025, initially as an affiliate of established RaaS operations (variously reported as Qilin, DragonForce, RansomHub and INC Ransom) before launching an independent brand and RaaS platform. The operator maintains a public presence on X/Twitter and engages directly with researchers, and has claimed prior embedded access within Conti's leadership (allegedly observing negotiations alongside 'Stern') — a self-reported claim that is unverified. In June 2025 a GangExposed doxing effort published alleged operator identity details; these have not been independently confirmed. Attribution to a nation-state is not asserted; this is a financially motivated cybercriminal.

First seen

2025-04

Last active

2026-02-04

Motivation

Financial (double-extortion ransomware / Ransomware-as-a-Service)

Attribution confidence

medium

MENA targeting

Egypt, UAE

Sectors

Government/defense, professional services

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting Egypt, UAE (Government/defense, professional services sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

RhysidaactorTechnique overlap
BianLianactorTechnique overlap
LynxactorTechnique overlap
SinobiactorTechnique overlap
BrainCipheractorTechnique overlap
SpacebearsactorTechnique overlap
NovaactorTechnique overlap
IncRansomactorTechnique overlap
The Gentlemenactor

Diamond Model

The four features of this adversary's intrusions under the Diamond Model — adversary, capability, infrastructure, victim — assembled from tracked data; pivot from any vertex to the others.

Adversary5

Who is behind the activity — operator vs. customer.

DevmanDevManDevman's PlaceDevman 2.0Devman2

Capability14

Tradecraft, techniques, and tooling the adversary employs.

14 ATT&CK techniquesImpactInitial AccessDefense EvasionDiscovery

Infrastructure

Physical/logical infrastructure used to deliver capability (C2, domains, relays).

No infrastructure indicators correlated in Radar yet.

Victim4

Targeting — sectors and geographies in scope.

Government/defenseprofessional servicesEgyptUAE

Social-political (intent)Financial (double-extortion ransomware / Ransomware-as-a-Service)

Operator ↔ CustomerOperator/affiliate model — the crew runs the intrusion; the RaaS brand and initial-access brokers are upstream parties.

Honesty note

Attribution ≠ confirmation. Devman is linked here via TTP overlap and shared infrastructure — not confirmed by original-source reporting. Treat this as a working hypothesis, not a settled fact.

See the analysis →

Kill Chain · Attack Flow

Useful?

Devman

Diamond Model

Kill Chain · Attack Flow

Analysis of Competing Hypotheses