devman Ransomware
Also known as: Devman 2.0 · Tracked since Apr 6, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Former RansomHub and INC Ransom affiliate.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1210 Exploitation of Remote Services Execution
T1059.001 PowerShellT1203 Exploitation for Client Execution Persistence
T1078 Valid Accounts Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1036 MasqueradingT1562.001 Disable or Modify Tools Credential Access
T1003 OS Credential Dumping Discovery
T1018 Remote System DiscoveryT1046 Network Service ScanningT1082 System Information Discovery Lateral Movement
T1021.002 SMB/Windows Admin Shares Collection
T1005 Data from Local System Exfiltration
T1041 Exfiltration Over C2 Channel Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1491 Defacement Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live