# Alleged Huntress Insider Leaked Law Enforcement Communications to DevMan Ransomware Operation (DragonForce/Conti Lineage)

> Former Huntress security analyst Ben Folland publicly alleged in June 2026 that a current Huntress employee passed US law enforcement (FBI) communications to DevMan, a ransomware group that emerged April 2025 as a DragonForce affiliate before launching an independent RaaS platform in September 2025. Huntress CEO Kyle Hanslovan acknowledged 'poor judgment in communicating with a cybercriminal' but disputed the 'insider' framing, citing active law enforcement coordination. If substantiated, the incident represents a critical supply-chain compromise of a managed detection and response (MDR) vendor with broad customer visibility into victim environments.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0970
- **ID:** TL-2026-0970
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** DevMan
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat record documents two interlinked intelligence threads: (1) an alleged insider threat at Huntress, a widely-deployed managed detection and response (MDR) vendor, and (2) the emergence and operations of DevMan, a ransomware group with direct lineage from DragonForce and ultimately Conti v3.

**Insider Threat at Huntress (Alleged)**
Ben Folland, a former Huntress security operations analyst, publicly alleged on social media in late June 2026 that a current Huntress employee passed US law enforcement communications — including FBI material — to operators of the DevMan ransomware group. Folland states he discovered the incident in December 2025 and resigned on February 19, 2026, citing irreconcilable conflict of interest. He claims the FBI identified the insider but that the individual remains employed at Huntress.

Folland promised to publish supporting evidence: direct communications between the Huntress employee and DevMan operators, FBI correspondence, recorded phone calls, internal Huntress memos, and evidence of threats made against Folland and his family. He also alleged Huntress was concealing the incident from partners, customers, and employees to protect an anticipated IPO.

Huntress CEO Kyle Hanslovan responded on Reddit, acknowledging that 'a former employee raised concerns that a teammate exercised poor judgment in communicating with a cybercriminal,' but strongly disputed the 'insider threat' characterization and the IPO prioritization accusation. Hanslovan noted that security researchers sometimes communicate with cybercriminals as part of legitimate intelligence-gathering — implying the contact may have been framed as research. He stated that active law enforcement coordination and legal proceedings prevent full public disclosure.

The supply-chain risk dimension is significant: Huntress has deep endpoint visibility across thousands of SMB and enterprise customer environments through its MDR platform. Any compromise of Huntress personnel — whether the insider leaked operational data, customer environment details, or law enforcement investigation timelines — could enable threat actors to evade arrest, time attacks optimally, or target Huntress-defended organizations with foreknowledge of detection capabilities.

**DevMan Ransomware: Emergence and Operations**
DevMan first appeared in mid-April 2025 as an affiliate of both Qilin (Agenda) and DragonForce, operating under the DragonForce 'Dragons-as-a-Service' cartel model. Early analysis by ANY.RUN and Broadcom confirmed that DevMan payloads were built using the DragonForce builder, inheriting code derived from the leaked Conti v3 source code (the February 2022 Conti leak that seeded numerous ransomware families).

The lineage chain is: **Conti v3 (leaked Feb 2022) → DragonForce (adapted Conti codebase, added BYOVD, ChaCha8) → DevMan (DragonForce affiliate, modified variant)**.

DevMan v1.0 technical profile:
- File extension: `.DEVMAN` (v1.0), `.devmanv1`, `.devman1` (v2.0)
- Ransom notes: `README.devmanv1.txt`, `README.txt`, `README.yAGRTb.txt`
- Critical builder flaw: self-encrypts its own ransom notes (encrypted notes renamed deterministically to `e47qfsnz2trbkhnt.devman`), undermining victim negotiation
- Encryption: AES-256 (CBC) + RSA-2048 hybrid
- Mutex: `hsfjuukjzloqu28oajh727190`
- C2: Primarily offline; SMB probing for lateral movement; no persistent external C2 beacon
- Registry persistence: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`; `HKCU\Software\Microsoft\RestartManager\Session0000`
- Platform inconsistency: wallpaper change works on Windows 10, fails on Windows 11 — indicative of incomplete QA

DevMan claimed 9 victims in April 2025 alone; by Q2 2025 had approximately 40-50 confirmed victims; by early 2026 over 120 confirmed victims spanning Asia-Pacific (majority), Africa, Europe, and North America.

In July 2025, researcher GangExposed doxed DevMan operators, triggering affiliate abandonment and operational disruption. DevMan recovered, simultaneously splitting from DragonForce and launching 'DevMan's Place,' an independent TOR-hosted leak site. In September 2025, DevMan launched DevMan 2.0 — a full RaaS platform with Rust-written encryptors for Windows, Linux/NAS, and ESXi; a web-based affiliate dashboard; GPO-based domain-wide deployment; and strict affiliate vetting requirements ($10,000 deposit, prior RaaS experience, 100+ GB exfiltrated proof-of-compromise). Revenue sharing tiers scale from 22% (targets under $20M revenue) down to negotiated rates for large enterprises.

**Attribution and Geopolitics**
DevMan enforces a CIS exclusion zone (will not attack CIS-region organizations) and a Serbia exclusion, as well as a prohibition on attacks against child-related healthcare entities. These geographic restrictions are consistent with Eastern European threat actor norms but do not confirm nation-state affiliation. No formal government attribution has been established.

The Huntress insider's identity and national affiliation remain unknown and alleged only; no criminal charges were public at the time of this research.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1547 Boot or Logon Autostart Execution
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1036 Masquerading
- T1112 Modify Registry
- T1003 OS Credential Dumping
- T1135 Network Share Discovery
- T1083 File and Directory Discovery
- T1018 Remote System Discovery
- T1069 Permission Groups Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1074 Data Staged
- T1213 Data from Information Repositories
- T1573 Encrypted Channel
- T1102 Web Service
- T1071 Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1491 Defacement

## Sources

- [Ex-Huntress analyst claims company insider fed info to a ransomware crim, social media drama ensues](https://www.theregister.com/cyber-crime/2026/06/25/ex-huntress-analyst-claims-company-insider-fed-info-to-a-ransomware-crim-social-media-drama-ensues/5262538)
- [DevMan Ransomware Analysis: New DragonForce Variant (ANY.RUN)](https://any.run/cybersecurity-blog/devman-ransomware-analysis/)
- [DevMan Ransomware Analysis of New DragonForce Variant (ANY.RUN Medium)](https://medium.com/@anyrun/devman-ransomware-analysis-of-new-dragonforce-variant-ede707fd30b1)
- [DEVMAN — New DragonForce Ransomware Variant (Broadcom Security Center)](https://www.broadcom.com/support/security-center/protection-bulletin/devman-a-new-dragonforce-ransomware-variant)
- [DragonForce Ransomware Variant Tied to Emerging DevMan Threat Actor (SC World)](https://www.scworld.com/news/dragonforce-ransomware-variant-tied-to-emerging-devman-threat-actor)
- [DevMan Threat Group Profile (Halcyon)](https://www.halcyon.ai/threat-group/devman)
- [DevMan RaaS Launch — The Affiliate Who Aims to Become the Boss (Analyst1)](https://analyst1.com/devmans-raas-launch-the-affiliate-who-aims-to-become-the-boss/)
- [From Conti to Black Basta to DevMan: The Endless Ransomware Rebrand (Vectra AI)](https://www.vectra.ai/blog/from-conti-to-black-basta-to-devman-the-endless-ransomware-rebrand)
- [New DevMan Ransomware by DragonForce (GBHackers)](https://gbhackers.com/new-devman-ransomware-by-dragonforce/)
- [Qilin Tops April 2025 Ransomware Report — DevMan Emerges (Cyble)](https://cyble.com/blog/qilin-tops-april-2025-ransomware-report/)
- [DevMan Ransomware Group Analysis 2026 (Ransom-DB)](https://www.ransom-db.com/blog/devman-ransomware-group-analysis-2026)
- [Insider Threats in Cybersecurity — Huntress Analyst Claims (CyPro)](https://cypro.co.uk/insights/cyber-bulletins/insider-threats-in-cybersecurity-huntress-analyst-claims/)
- [Former Huntress Analyst Alleges Insider Misconduct and Concealment of Security Incident (QPulse)](https://qpulse.quasarcybertech.com/news/4342/former-huntress-analyst-alleges-insider-misconduct-and-concealment-of-security-incident)
- [DragonForce Ransomware Cartel vs. Everybody (Barracuda Networks)](https://blog.barracuda.com/2025/06/09/dragonforce-ransomware-cartel-vs--everybody)
- [Ransomware Spotlight: DragonForce (Trend Micro)](https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0970