devman
Devman 2.0
Former RansomHub and INC Ransom affiliate.
source: ransomware.live1 refs →
devman
Devman is a cybercrime actor known for RDP-based ransomware operations, affiliated with RansomHub and INC Ransom.
Analyst brief
Devman (also known as Devman 2.0) is a cybercrime actor, formerly affiliated with the RansomHub and INC Ransom groups. They primarily target organizations across various sectors. Their typical TTPs involve exploiting Remote Desktop Protocol (RDP) weaknesses for initial access, stealing data, and deploying ransomware. Defenders should focus on strengthening RDP security, enforcing multi-factor authentication, and monitoring for unusual lateral movement activity within the network.
crime
FAQ2
What method does the Devman actor commonly use for initial network access?
Devman typically gains initial access by exploiting Remote Desktop Protocol (RDP) weaknesses.
What key measures should defenders take to protect against the Devman actor's attacks?
Defenders should strengthen RDP security, enforce multi-factor authentication (MFA), and monitor for unusual lateral movement activity within the network.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.