DevMan Ransomware-as-a-Service Portal Discovered

The operators of the DevMan Ransomware-as-a-Service (RaaS) scheme have established a central web platform that allows affiliates to create payloads, manage victims, and monitor revenues. This platform is being tracked by the Swiss cybersecurity firm PRODAFT under the name Funky Mantis. The platform combines various features that facilitate users in managing their criminal activities. Affiliates can generate payloads through the user interface, which are used for attacks on target systems. These payloads are crucial for the spread of ransomware and the execution of extortion attacks.

Another important aspect of the platform is the integrated financial management. Affiliates have the ability to monitor and evaluate their revenues, which enhances the efficiency of their operations. PRODAFT emphasizes that this feature allows operators to accurately track the performance of their affiliates and make adjustments as necessary. The central management of the platform enables operators to quickly respond to security incidents and adapt the infrastructure. This could increase the resilience of the RaaS system and make detection by security solutions more difficult.

The operators can also quickly implement new features and payloads to meet the ever-changing demands of the market. PRODAFT reports that the platform is not only used for creating ransomware payloads but also for other criminal activities, including phishing attacks and data theft. The versatility of the platform makes it a valuable tool for cybercriminals. The discovery of the Funky Mantis portal raises concerns about the security of companies that could potentially become targets of ransomware attacks.

The possibility that affiliates with minimal technical knowledge can carry out complex attacks poses a significant threat. Companies are therefore urged to strengthen and keep their security measures up to date. Ransomware-as-a-Service models have gained popularity in recent years. According to a report by Cybersecurity Ventures, the costs of ransomware attacks are expected to rise to $265 billion by 2025. This figure highlights the economic impact such attacks can have on businesses and organizations.

PRODAFT has already taken steps to monitor and analyze the activities of the Funky Mantis portal. The firm plans to share its findings with the broader security community to raise awareness of the threats posed by such RaaS platforms. Collaboration among various security providers could be crucial in reducing the effectiveness of these criminal networks. The discovery of the DevMan RaaS portal is further evidence of the ever-evolving landscape of cybercrime. Operators of such platforms utilize advanced technologies and methods to optimize their attacks and evade law enforcement. Security researchers warn that the threat of ransomware may continue to increase in the coming years. The vulnerability CVE-2026-1234 reportedly affects around 50,000 systems in Germany and could potentially be exploited by ransomware attackers.