# DevMan RaaS ("Funky Mantis") Centralizes Payload Builds, Victim Management, and Affiliate Payouts, Develops SCADA-Destructive Locker

> DevMan, tracked by PRODAFT as "Funky Mantis", is a DragonForce/Conti-lineage ransomware-as-a-service platform whose v3 portal (Jan 2026) centralizes payload builds, victim lifecycle management, finance, and affiliate payouts. The group has claimed 184 victims (~50 U.S.) as of Feb 2026 and has acknowledged development of a dedicated SCADA locker intended to push industrial control systems beyond thermal/processor/memory operating limits to induce hardware failure.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1680
- **ID:** TL-2026-1680
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DevMan
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DevMan is a closed ransomware-as-a-service (RaaS) operation that emerged in April 2025 as an affiliate program working under Qilin, DragonForce, Apos, and RansomHub before evolving into an independent, DragonForce-derived lineage ("unmistakably DragonForce" per Vectra AI) with acknowledged Conti operator collaboration from October 2025. PRODAFT's Catalyst intelligence unit tracks the operation under the internal codename "Funky Mantis" and has identified operator handles LARVA-367 (administrator/owner), LARVA-546 (access coordinator), LARVA-547 and LARVA-548 (senior operators/coordinators), and LARVA-550 (affiliate/operator).

The group's core differentiator is a formal, browser-based affiliate portal that unifies payload generation, victim records with lifecycle states, per-victim build configuration, deadline tracking, revenue and financial tracking, team creation, shared operational access, victim chat, and a help desk. Version 1-2 of the portal (through December 2025) covered builders, finance, victim chat, support, and program rules; the January 2026 v3 release added structured victim records, lifecycle states, team creation, per-victim build options, deadline tracking, revenue fields, and shared operational access -- indicating significant operational maturation typically associated with larger, better-resourced RaaS operations (DragonForce, Qilin, RansomHub class).

Technically, the ransomware locker (available for Windows, VMware ESXi, and Linux, with a SCADA-specific variant in development) uses multi-threaded ChaCha20-Poly1305 encryption per PRODAFT's most recent locker analysis, while earlier builder generations (v1.0 C++, v2.0 Rust rewrite) analyzed independently by ANY.RUN and Halcyon used a hybrid AES-256 (CBC) + RSA-2048 asymmetric scheme with full, header-only, and custom encryption modes. Files at or below 3 MiB are fully encrypted; files above 3 MiB receive partial/intermittent encryption (roughly 1 MiB encrypted per 51 MiB) to accelerate large-scale encryption runs. The locker abuses the Windows Restart Manager API (writing to HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000) -- a technique inherited from the Conti lineage -- to release file locks held by active processes, enabling encryption of files in use. Pre-encryption behavior includes privilege-escalation verification, security-control impairment (AV/EDR termination), process/service termination, Volume Shadow Copy and backup/recovery inhibition, Windows Event Log clearing, local and network-share discovery, lateral movement, and optional self-deletion after completion.

Intrusion tradecraft observed across the DevMan/Funky Mantis affiliate base includes phishing with malicious attachments, RDP brute-forcing, and exploitation of edge-facing applications for initial access; BloodHound for Active Directory attack-path mapping and SoftPerfect Network Scanner plus SMB share enumeration for discovery; Mimikatz for LSASS credential dumping alongside a custom infostealer targeting Chrome/Firefox stored credentials; PsExec over admin shares, RDP with stolen credentials, and GPO deployment from compromised domain controllers for lateral movement and privilege escalation; and a largely offline operational model with minimal external C2 beaconing, TOX encrypted messaging for victim/affiliate communication, and dedicated Tor (.onion) leak sites with countdown timers for double-extortion pressure. Exfiltrated data volumes typically range 50GB-300GB (maximum documented 2.5TB), commonly staged to Mega.nz ahead of encryption (data-exfiltration-first methodology).

The affiliate economics follow an 80/20 revenue split in the affiliate's favor, paid out via two separate cryptocurrency wallets (affiliate wallet and RaaS-program wallet). Affiliates are only admitted to the operation's corporate chat after producing a first victim, are removed after one month without a new victim, and require curator approval to form teams or disclose program affiliation; management retains the right to take over victim negotiation conversations for policy violations. Targeting policy explicitly prohibits attacks on CIS-country and Serbian entities, CIS consulates and CIS-linked companies, and child-related healthcare businesses, and bars intentional leaks of minors' personal data (a prior restriction on Saudi Arabia targets was lifted); critical-infrastructure attacks are explicitly encouraged, and affiliates targeting industrial/OT environments are instructed to request a separate SCADA-specific encryptor build.

The most operationally significant claim is DevMan's acknowledged development (from October 2025) of a specialized SCADA/ICS locker designed to "push industrial control systems beyond their operating parameters, processors, memory, and thermal limits, forcing systems to ramp up and run hot until hardware failed" -- i.e., a destructive payload intended to cause physical equipment damage rather than pure data-encryption extortion, elevating the operation from a financial-crime concern to a critical-infrastructure safety concern.

In a related but distinct incident, a former Huntress employee (Ben Folland) is alleged to have disclosed FBI communications -- including screenshots containing FBI agent names -- to a DevMan operator in December 2025; Huntress's CEO characterized the conduct as "poor judgment" while Huntress's continuing investigation has not yet identified evidence of illegal conduct, though industry commentary has framed Folland's actions as an insider threat.

Builder-quality issues have also been documented: a builder misconfiguration causes the malware to frequently encrypt its own ransom note (filename e47qfsnz2trbkhnt.devman, itself likely a deterministic artifact of the flawed builder), rendering it inaccessible to victims, and the desktop-wallpaper-change routine fails on Windows 11, indicating incomplete OS/version testing despite the platform's stated operational maturity.

Victimology to date spans 184 claimed victims (~50 in the United States) concentrated in technology, healthcare, financial services, professional services, and government sectors, with earlier independent tracking (Halcyon, RansomLook) showing over 60% Asia-Pacific concentration (Taiwan, Thailand, China, Japan, Singapore) plus secondary African operations (including Kenya's NSSF) and confirmed victims in Mexico, Spain, Hong Kong, Greece, and Brazil, alongside expanding European and North American presence. Reported ransom demands have ranged from $60K-$2.5M in the v1.0 era (Apr-Jun 2025) to $1M-$91M following the v2.0 Rust rewrite (Jul-Oct 2025), with revenue thresholds reportedly guiding affiliate targeting decisions ($100M+ revenue for critical infrastructure, $50M+ for healthcare).

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1482 Domain Trust Discovery
- T1021 Remote Services
- T1484 Domain or Tenant Policy Modification
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1529 System Shutdown/Reboot
- T1567 Exfiltration Over Web Service
- T1071 Application Layer Protocol
- T1569 System Services

## Sources

- [DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts](https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html)
- [Funky Mantis: Platform, Coordination and Locker Analysis](https://catalyst.prodaft.com/public/report/funky-mantis-platform-coordination-and-locker-analysis/overview)
- [DEVMAN Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/devman/)
- [DevMan Threat Group Profile](https://www.halcyon.ai/threat-group/devman)
- [Devman · RansomLook](https://www.ransomlook.io/group/devman)
- [Ransomware.live: devman](https://www.ransomware.live/group/devman)
- [DEVMAN: Ransomware Overview](https://medium.com/@anyrun/devman-ransomware-overview-32600d4da684)
- [10 New Ransomware Groups Of 2025 & Threat Trends For 2026](https://cyble.com/knowledge-hub/10-new-ransomware-groups-of-2025-threat-trend-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1680