# Alleged Insider Threat at Huntress: Analyst Accuses Employee of Leaking US Law-Enforcement Communications to DevMan Ransomware Operator

> Former Huntress SOC analyst Ben Folland publicly alleged that a current Huntress employee passed US law-enforcement communications to a cybercriminal tied to the DevMan ransomware operation (a modified-DragonForce, Conti-lineage RaaS that emerged April 2025). Huntress CEO Kyle Hanslovan acknowledged a teammate 'exercised poor judgment' communicating with a possible cybercriminal, framing such contact as intelligence-gathering, while FBI coordination and ongoing legal proceedings limit disclosure.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-06-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0945
- **ID:** TL-2026-0945
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** DevMan
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 25 June 2026 The Register reported a public dispute in which Ben Folland, a former Huntress security operations analyst whose last day was 19 February 2026, alleged that a still-employed Huntress staffer had passed sensitive US law-enforcement communications to a cybercriminal associated with the DevMan ransomware operation. Folland said he first discovered the alleged insider activity in December 2025, that the employee was 'caught by the FBI' yet remained employed, and that he himself was subsequently targeted (including threats referencing his family). Folland further alleged Huntress prioritized an upcoming IPO over client security and used legal threats to silence him. The dispute surfaced publicly in June 2026 as Folland responded to Huntress's disclosure of the Klue Salesforce supply-chain compromise (Huntress was among hundreds of Klue victims; the Klue data theft was claimed by the 'Icarus' extortion group).

Huntress CEO Kyle Hanslovan responded that a teammate 'exercised poor judgment in communicating with a' potential cybercriminal, asserting that security researchers occasionally maintain such contact to gather intelligence, and that ongoing legal proceedings and FBI coordination constrained what the company could say publicly.

This record is an insider-threat / supply-chain-trust intelligence item, not a vulnerability: the source article reports no CVE, malware hashes, or network IOCs specific to the alleged leak itself. The threat significance is the human-trust failure at a widely-deployed security vendor (an EDR/MDR provider with privileged telemetry across customer estates), where an insider with access to law-enforcement-sensitive communications allegedly fed them to a ransomware operator. The counterparty, DevMan, is a well-documented threat: it emerged in mid-April 2025 as an affiliate of Qilin/Agenda and DragonForce, split to operate independently using a modified version of the leaked DragonForce builder (itself derived from leaked Conti source) in July 2025, and launched the 'DevMan 2.0' Ransomware-as-a-Service platform on 30 September 2025. DevMan exhibits Conti-derived Windows Restart Manager abuse, SMB/ADMIN$ lateral movement, three encryption modes (full, header-only, custom), a .DEVMAN extension, a hardcoded mutex, builder flaws (self-encrypting ransom notes; wallpaper change failing on Windows 11), and Russian-language / CIS-Serbian affiliate ties. The DevMan-side malware and infrastructure IOCs in this record are documented from public ANY.RUN and Analyst1 reporting and are included to support hunting and attribution; the insider-leak allegation itself remains unproven and under legal/FBI process.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1204 User Execution
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1135 Network Share Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1491 Defacement
- T1657 Financial Theft

## Sources

- [Ex-Huntress analyst claims company insider fed info to a ransomware crim, social media drama ensues](https://www.theregister.com/cyber-crime/2026/06/25/ex-huntress-analyst-claims-company-insider-fed-info-to-a-ransomware-crim-social-media-drama-ensues/5262538)
- [DEVMAN Ransomware: Analysis of New DragonForce Variant](https://medium.com/@anyrun/devman-ransomware-analysis-of-new-dragonforce-variant-ede707fd30b1)
- [Devman's RaaS Launch: The Affiliate Who Aims to Become the Boss](https://analyst1.com/devmans-raas-launch-the-affiliate-who-aims-to-become-the-boss/)
- [From Conti to Black Basta to DevMan: The Endless Ransomware Rebrand](https://www.vectra.ai/blog/from-conti-to-black-basta-to-devman-the-endless-ransomware-rebrand)
- [DEVMAN - a new DragonForce ransomware variant (Protection Bulletin)](https://www.broadcom.com/support/security-center/protection-bulletin/devman-a-new-dragonforce-ransomware-variant)
- [Ransomware Spotlight: DragonForce](https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce)
- [Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress](https://www.huntress.com/blog/klue-breach-investigation)
- [Security shops among the 'hundreds' of Klue hack victims](https://www.theregister.com/cyber-crime/2026/06/22/security-shops-among-the-hundreds-of-klue-hack-victims/5259743)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0945