Threat Intelligence Report April 29 - May 5 2025

Devman Ransomware Group

Devman burst onto the scene in mid-April 2025, appearing on the dark web leak markets with an initial wave of more than a dozen victims. Early chatter on threat-intel forums suggests the operator is a former affiliate of the Qilin/Agenda RaaS who has split off to launch a brand-new franchise while still collaborating on some jobs. Public breach posts credited jointly to “Qilin & Devman” (e.g., the Feel Four S.L. retail attack) confirm that the newcomer is already comfortable partnering with established crews.

From the start, Devman has embraced a double-extortion business model: data is stolen first, then systems are encrypted, and finally the victim is pressured with public disclosure on a leak portal if payment is refused. Victims span retail, construction, healthcare, manufacturing, and IT services across Asia, Europe, Africa, and North America, underscoring an opportunistic, RaaS-style targeting philosophy rather than a single-sector focus.

Detailed TTPs

Devman ransomware campaigns begin by exploiting vulnerable perimeter services such as unpatched VPN gateways or ESXi hosts. A 64-bit payload runs with administrator privileges, leveraging native APIs and command-line execution. Persistence and lateral spread rely on scheduled services, Run-key hijacking, and PsExec-driven SMB propagation. The malware escalates privileges through service abuse, then disables security products and wipes Windows or ESXi logs. It enumerates shares and domains, stages stolen data, and exfiltrates archives through encrypted channels. Negotiations use peer-to-peer Tox while a public leak site amplifies pressure. Finally, robust encryption and snapshot deletion cripple recovery, forcing ransom payments from victims worldwide.

TTP Chart

IOCs

Other Indicators

• Surge in CPU/Disk utilisation as w.exe (or similarly named binary) spawns across servers.
• Sudden stop of backup/AV services (vss, sql, vmware-hostd, etc.).
• Large outbound traffic burst to Tor relay IPs just before encryption.

Ransomware Victims Worldwide

A fresh review of public victim-site postings for the current period confirms that the United States remains the epicentre of ransomware activity, absorbing an outsized 44.55% of all known incidents. The figure is even higher than last period’s 39.62%, underscoring the country’s unmatched concentration of high-value infrastructure and data-rich enterprises that continue to attract both profit-driven and geopolitically motivated actors.

Canada emerges as a distant—but still notable—second with 6.36% of global cases, signalling a steady rise in attacks across North America outside the US mainland. Germany follows at 4.55%, reflecting the persistent targeting of Europe’s industrial and manufacturing heartland. A trio of nations each record 3.64% of incidents: Italy, Australia, and China. Italy’s presence highlights sustained Southern-European exposure, while concurrent activity in Australia and China points to the Asia-Pacific theatre’s growing importance for threat actors seeking both Western and regional targets.

The mid-tier impact is visible in the United Kingdom (2.73%) and Saudi Arabia (2.73%), alongside Argentina and South Africa (each 2.73%). These numbers suggest that both established economies and key emerging markets remain firmly on adversaries’ radar. Nations posting 1.82% of incidents include Malaysia, Georgia, Japan, and Singapore—an indicator of ransomware’s reach into South-East Asian, Caucasian, and East-Asian digital ecosystems.

A broad long-tail of countries each account for 0.91% of reported cases—among them Brazil, Portugal, Taiwan, The Netherlands, Spain, Malta, Jordan, Thailand, Hungary, Peru, France, Luxembourg, Vietnam, India, Costa Rica, New Zealand, and the island nation of Fiji. Although individual volumes are low, the sheer geographic diversity of these sightings underlines ransomware’s truly transnational footprint.