Loading threat actor…
DevMan, also known as Funky Mantis, is a centralized ransomware-as-a-service operation observed between November 2025 and January 2026. The operation managed affiliates through a dedicated portal that supported access distribution by country, payload generation, ransom negotiation, revenue tracking, and later victim lifecycle management, deadline tracking, team creation, and invitation-based collaboration. Internal coordination used Rocket.Chat, and the program operated with a structured revenue-sharing model characteristic of an organized RaaS enterprise. DevMan explicitly targeted hospitals, critical infrastructure, the public sector, and law enforcement. The operation also advertised a separate encryptor for SCADA environments, indicating interest in operational technology and disruptive attacks against critical services. Reported geographic targeting included Norway, the United States, Italy, France, Morocco, China, the Philippines, Brazil, and Chile. Its Windows ransomware payload, Devman Locker, was compiled in Rust and used ChaCha20-Poly1305 for file encryption. The malware supported full encryption of smaller files and partial encryption of larger files to accelerate impact. Observed behavior included disabling security controls, deleting shadow copies, inhibiting system recovery, terminating selected processes and services, clearing event logs, and discovering and mounting network shares to expand encryption scope across accessible systems. These behaviors align with defense evasion, post-compromise disruption, and broad-impact ransomware deployment. Known operator roles included LARVA-367 as the main administrator or owner, LARVA-546 as a co-curator or access coordinator, LARVA-547 as a curator or senior operator, LARVA-548 as a senior coordinator assigned to hospitals, and LARVA-550 as an affiliate or operator. The affiliate model offered high revenue shares to participants, reinforcing DevMan’s role as a structured criminal service rather than an opportunistic single-team campaign.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.