PRODAFT Exposes DevMan (Funky Mantis) RaaS Portal: Integrated Affiliate CRM with Access Brokerage, Country-Specific Networks, and 2–3 Day Completion Windows

Swiss threat intelligence firm PRODAFT has published detailed analysis of DevMan ransomware (tracked as Funky Mantis), revealing a fully operationalized v3 affiliate portal launched in January 2026 that consolidates payload builds, victim lifecycle management, deadline tracking, team creation, and automated revenue sharing into a single CRM-style platform. DevMan originated in April 2025 as an affiliate of Qilin, DragonForce, and RansomHub before pivoting to its own RaaS after a payment dispute. The portal integrates access brokerage directly with ransomware deployment and imposes mandatory two-to-three day completion windows on affiliates, industrializing attack tempo.

DevMan originated in April 2025 as an affiliate of Qilin, DragonForce, and RansomHub before pivoting to its own RaaS after a payment dispute.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.