DevMan RaaS Platform Exposes New Cybercrime Infrastructure
Cybercriminals are using a centralized portal to streamline ransomware operations. The platform enables payload building, victim tracking, and affiliate payouts under one roof.
TL;DR
- DevMan RaaS operators use a centralized web portal called 'Funky Mantis' to manage cybercrime operations
- The platform allows affiliates to generate payloads, track victims, and manage earnings
- Swiss cybersecurity firm PRODAFT is monitoring the operation
- Centralized RaaS portals increase operational efficiency for cybercriminals
- Security teams should monitor for similar infrastructure patterns in threat intelligence
A new ransomware-as-a-service (RaaS) operation named DevMan is leveraging a sophisticated web-based portal to centralize criminal activities. According to Swiss cybersecurity firm PRODAFT, the platform streamlines the entire ransomware workflow, from payload generation to victim management and affiliate compensation.
This centralized approach represents an evolution in cybercrime infrastructure, making it easier for less technically skilled criminals to participate in ransomware campaigns. The operation has been tracked under the codename Funky Mantis, highlighting the professional nature of modern ransomware services.
Platform Capabilities
- The portal integrates payload building tools that allow affiliates to create customized malware variants
- Victim management features enable tracking of encrypted systems and ransom payments
- Built-in financial systems handle affiliate commission calculations and payouts
- Centralized dashboard provides real-time operational metrics for administrators
Security Implications
- Centralized platforms create single points of failure that law enforcement can target
- Web-based interfaces leave digital footprints that security researchers can analyze
- Standardized toolsets make it easier to develop detection signatures
- Monitoring for similar infrastructure patterns can help predict future attacks
- Organizations should enhance email filtering to block access to known RaaS domains
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.