Threat Actor Characterization
You’re viewing the read-only version.
Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
DevMan
ID: 38010cb4afb2f2b4f97a852776090b9338942
Crimeware
Ransomware
Threat types: Malware, Ransomware, RaaS, Intrusion, Phishing
Progress: 83%
Completeness: 89%
Freshness: 70%
Operation zone: Brazil, Canada, France, Greece, Japan, Singapore, South Africa, Spain, Thailand, United Kingdom, Vietnam
Aliases
Limited alias preview
| DragonForce | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
31622d85a3826aa600d14a779a5f9cb796975 | DragonForce Malaysia | Malaysia | related | Hacktivist Group |
Related files
| Filename | Size | SHA-1 | OS target | Identified |
|---|---|---|---|---|
| 6boxtqti.exe | 630.41 KB | aede3562************************378d0e0f | Malware | |
| 7d7gs.exe | 429.34 KB | ae3577c1************************c3f5992b | Malware | |
| px2lsy3.exe | 588.51 KB | 0bffd0bb************************377ec821 | Malware | |
| ntdll.dll | 418.51 KB | 818d0e90************************e5bfc49f | Malware | |
| ntdll.dll | 418.51 KB | 84d3cba5************************ae0dae84 | Malware | |
| newfile.zip | 532.47 KB | def85543************************b96e5746 | Malware | |
| requested-items.zip | 3.37 MB | ed9d993f************************ca9b4906 | Malware | |
| 9lz3uqt6.exe | 429.34 KB | bb3af28f************************5b485909 | Malware | |
| 3xcccg.exe | 429.34 KB | 7888bd3a************************fce0e578 | Malware | |
| rvnoat.exe | 540 KB | 503eef53************************119f681a | Malware | |
| ntdll.dll | 418.51 KB | 4a34bbad************************8e9a7e26 | Malware |
Free preview hides direct file links and partially masks file hashes.
Actor Network Graph
Open Network GraphMITRE ATT&CK®
confidence: medium
DevMan is a ransomware variant/cluster reported since 2025 and commonly described as DragonForce-linked. Official alerting on DevMan 2.0 describes double extortion, common access routes (compromised credentials, phishing, exposed services), SMB admin-share lateral movement, recovery inhibition (shadow copy deletion), and Tor extortion infrastructure.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1566 | Phishing | TA0001 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1021.002 | SMB/Windows Admin Shares | TA0008 |
|
| T1490 | Inhibit System Recovery | TA0040 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
Executive brief
now
Saved successfully.
Hunting Playbook
now
Saved successfully.
IOC Appendix
now
Saved successfully.
OSINT Library
now
Saved successfully.
