← All ransomware groups
Devman logo

Ransomware group profile · #37 by claimed victims

Devman ransomwarealso Devman 2.0

Former RansomHub and INC Ransom affiliate.

Active First seen Apr 2025
184Victims claimed on leak sites
0Victims in the last 30 days
0Victims in the last 90 days
39Countries hit
1Leak-site URLs tracked, 0 online
4 Feb 2026Latest claim recorded

Victimology

Who Devman claims to have breached, from 184 leak-site posts recorded by VULONE.

Claims per month last 12 months

Oct 2025: 19OctNov 2025: 13Dec 2025: 47Jan 2026: 30JanFeb 2026: 2Mar 2026: 0Apr 2026: 0AprMay 2026: 0Jun 2026: 0Jul 2026: 0JulAug 2026: 0Sep 2026: 0

Top sectors

Technology31
Healthcare28
Financial Services16
Professional Services15
Government & Defense14
Retail & E-Commerce11
Manufacturing9
Agriculture and Food Production7

Top countries

United States44
France9
Taiwan7
SJ7
Brazil6
South Africa6
Canada6
Thailand6

Latest claimed victims 12 most recent

VictimSectorCountryClaimed
Crystal Coast Pain Management crystalcoastpm.com Healthcare US 4 Feb 2026
ENCOMPASS-INC encompass-inc.com Financial Services US 2 Feb 2026
woodwardoralsurgery.com woodwardoralsurgery.com Healthcare SJ 30 Jan 2026
wjnklaw.com wjnklaw.com Professional Services US 30 Jan 2026
consultaegis.com consultaegis.com Government & Defense US 29 Jan 2026
zallc.org zallc.org Financial Services US 29 Jan 2026
***vandenberg.com ***vandenberg.com Not Found US 28 Jan 2026
**ps.net **ps.net Not Found US 28 Jan 2026
tiw-group.com tiw-group.com Technology SJ 28 Jan 2026
z*l*c.o*g z*l*c.o*g Financial Services US 28 Jan 2026
twi-group.com twi-group.com Transportation US 27 Jan 2026
c*n**lta**i*.com c*n**lta**i*.com Government & Defense US 26 Jan 2026

All 184 Devman victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Devman is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Devman ransomware still active?
Devman is tracked as active. The most recent leak-site claim VULONE recorded is dated 4 February 2026.
How many victims has Devman claimed?
VULONE has recorded 184 leak-site victim claims attributed to Devman since April 2025, across 39 countries and 14 sectors.
Which industries does Devman target?
The sectors most often named on the Devman leak site are Technology, Healthcare, Financial Services.
Which countries are most affected by Devman?
Most Devman victims recorded by VULONE are located in United States, France, Taiwan.
Where does VULONE get Devman victim data?
Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Qilin logoQilin2,310 victims Lockbit3 logoLockbit32,016 victims Akira logoAkira1,618 victims Clop logoClop1,344 victims Play1,316 victims Lockbit21,002 victims Incransom936 victims Thegentlemen867 victims

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].