← Back to Feed
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
July 25, 2026 · The Hacker News · Severity: CRITICAL
The DevMan ransomware-as-a-service operation, tracked as Funky Mantis by PRODAFT, maintains a dedicated web platform offering affiliates payload building, earnings oversight, victim management, and payout functions. First emerging in April 2025 as an affiliate for Qilin, DragonForce, Apos, and RansomHub, DevMan later shifted to its own RaaS operation. The ransomware's DNA is described as unmistakably DragonForce. The portal includes build generation, finance, victim chat, support, victim records, teams, and payout systems.
Key Takeaways
- DevMan RaaS provides affiliates a centralized web portal for payload builds, victim management, and affiliate payouts.
- Tracked as Funky Mantis by PRODAFT, DevMan emerged April 2025 initially as an affiliate for other ransomware groups.
- Portal features include build generation, finance, victim chat, support, and country-specific network access.