Devman

☆ pin

Also known as DevMan, Funky Mantis

Reports

First seen

May 12, 2026

Last seen

Jul 25, 2026

Motivation

Financial

Targeting

Sectors

Other ×1

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×3T1021 Remote Services ×3T1562 Impair Defenses ×3T1566 Phishing ×2T1133 External Remote Services ×2T1491 Defacement ×1T1078 Valid Accounts ×1T1190 Exploit Public-Facing Application ×1T1547 Boot or Logon Autostart Execution ×1T1136 Create Account ×1T1565 Data Manipulation ×1T1018 Remote System Discovery ×1

Indicators

domain ×1filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-40766 (exploited)CVE-2024-47575 (exploited)CVE-2024-50383 (exploited)

Recent reports

High

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

The Hacker NewsJul 25, 2026 Info

Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft

Huntress BlogMay 20, 2026 High

State of ransomware in 2026: post-quantum cryptography, encryptionless extortion, and industrialized access brokers

Kaspersky SecurelistMay 12, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.