Dev Man RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
Summary: PRODAFT is tracking the DevMan ransomware-as-a-service operation, which runs a dedicated affiliate portal combining payload builds, finance, victim chat, support, victim records, teams, and payouts, and released a v3 platform in January 2026 adding structured victim records, life cycle states, team creation, and per-victim build options. DevMan emerged in April 2025 as an affiliate for Qilin, DragonForce, Apos, and RansomHub before launching its own RaaS, has claimed 184 victims per Ransomware.Live with no new victims after February 4, 2026, and splits extortion proceeds 80-20 between affiliate and program.
What you should know: The operation's stated policy explicitly encourages attacks on critical infrastructure and instructs affiliates to request a separate encryptor for SCADA systems, corroborating its claimed development of a locker designed to push industrial control systems past operating parameters until hardware fails. Its governance model - curators assigned after a first victim, removal after a month without a new one, and administrator power to take over conversations - shows a program built to enforce operational tempo and protect revenue rather than a loose chat-based crew.
Read the original at The Hacker News ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026