mantis

The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administered RaaS operation under the name Funky Mantis. "The portal combined build generation, finance, victim chat, support, victim records, teams, and payout functions," the company said in an extensive report shared with The Hacker News. "The service integrated access brokerage or access distribution with ransomware deployment. Administrators offered country-specific 'networks,' asked whether an affiliate would use personal or program-supplied access, and imposed two-to-three-day completion windows." Various analyses show that DevMan first emerged on the scene in April 2025 as an affiliate for Qilin, DragonForce, Apos, and RansomHub, before shifting to their own RaaS operation. The locker's DNA is "unmistakably DragonForce," Vectra AI noted back in October 2025, highlighting the ransomware's shared lineage. In an interview with security researcher Jon DiMaggio published in October 2025, DevMan acknowledged that they worked with Conti and claimed they had developed a "specialized SCADA locker" to target an unnamed gas company that was designed to inflict progressive physical damage beyond encryption. Per the threat actor, the malware would "push industrial control systems beyond their operating parameters, processors, memory, and thermal limits, forcing systems to ramp up and run hot until hardware failed." "The threat actor is operating with a high-profile online presence and updating about developments, updates and general statements mainly in English and sometimes in Russian as well," the Israel National Cyber Directorate (INCD) said in a bulletin released last year. "They often 'brag' about their achievements, to the point where they post write-ups that describe the way they gained access and performed the attack." DevMan's operations suffered a hit in June 2025 after a mysterious whistleblower calling themselves GangExposed publicly doxxed operator identities, causing a few affiliates to abandon the operation. DevMan also alleged that GangExposed attempted to extort them for 0.3 to 1 Bitcoin during their Telegram interactions. According to statistics on Ransomware.Live, the group has claimed 184 victims to date, with no new victims reported after February 4, 2026. Nearly 50 victims are located in the U.S., with technology, healthcare, financial services, professional services, and government sectors accounting for the most targeted. PRODAFT told The Hacker News that there is currently no "solid evidence" as to why the RaaS operation has shut down. However, the cybersecurity company assessed with moderate confidence that the individual previously under the DevMan moniker is still active. Based on HUMINT-derived information and behavioral analysis, the threat actor is said to be "no longer leading a partnership program but working as an affiliate with RaaS groups." The affiliate portal associated with the operation, which originally revolved around builders, finance, victim chat, and help desk functions, has since received an upgrade. The third version ("v3) of the platform released in January 2026 comes with support for structured victim records, life cycle states, team creation, invitation controls, per-victim build options, deadline tracking, revenue fields, and shared operational access. "This progression indicates an effort to formalize affiliate workflows and manage multiple intrusions through a common platform rather than relying only on chat-based coordination," PRODAFT said. The cybersecurity company has identified five distinct roles within the DevMan operations - LARVA-367 - Administrator/owner and central coordinator LARVA-546 - Access coordinator named as an alternative point of contact for network access LARVA-547 - Senior operator LARVA-548 - Senior operator or coordinator LARVA-550 - Affiliate/operator who was credited for an installation in an actor-controlled group message "Affiliates were added to corporate chat after producing a first victim and were assigned an experienced curator," PRODAFT said. "They could be removed after one month without a new victim. Team formation and disclosure of program affiliation required curator approval, which limited independent coordination and public association with the service." The core management also reserves the right to take over a conversation if an affiliate behaves inappropriately or fails to adhere to a commitment. The governance model reduces affiliate autonomy, while giving the administrators the power to enforce operational tempo and protect their revenue. The illicit proceeds obtained after successful extortion follow an 80-20% split, allowing the affiliate to earn a chunk of the profits. The v3 platform rules state that the ransom funds are sent to two wallets, one for the affiliate and one linked to the RaaS program. DevMan's stated targeting policy allows affiliates to strike entities outside the CIS countries and Serbia. It also excludes CIS consulates and CIS-linked companies, and lifts a previous restriction on Saudi Arabia. Besides explicitly encouraging attacks against critical infrastructure, it instructs affiliates to request a separate encryptor for SCADA systems, corroborating their development on a specialized SCADA locker. However, the policy forbids affiliates from attacking child-related healthcare businesses and intentional leaks of personal data belonging to people under the age of 18. The latest version of the portal allows affiliates to create a locker for Windows, ESXi, or Linux. An analysis of the Windows version has identified functions related to privilege checking to determine if it's running as an administrator, security-control impairment, process and service termination, recovery inhibition, event log clearing, local and network-share discovery, lateral movement, multi-threaded encryption, ransom-note creation, and optional self-deletion. The locker encrypts files with ChaCha20-Poly1305. Files up to and including 3 MiB are fully encrypted, while those above the threshold are partially encrypted by processing a 1 MiB chunk every 51 MiB. "Organizations should prohibit service and backup accounts from interactive VPN login unless a documented operational requirement exists," PRODAFT said. "Remote access and privileged administration should use phishing-resistant MFA. Teams should rotate credentials exposed to VPN appliances, LDAP integrations, scripts, and backup tooling, with priority given to secrets that can grant local or domain administrative access." Huntress Faces Insider Threat Allegations The disclosure also comes at a time when Ben Folland, a former employee of security firm Huntress, accused another analyst of passing communications from U.S. law enforcement to DevMan. The incident is said to have taken place in December 2025. In a subsequent blog post, Huntress CEO Kyle Hanslovan said the company is aware of "questionable, long-term threat actor communications" between a threat researcher who is still employed with the security firm and a cybercriminal, calling it "poor judgement." "In one particular exchange, our current teammate disclosed to a threat actor that law enforcement had reached out to them about the threat actor," Hanslovan said. "While this disclosure was not illegal, it reflected poor judgment." "As a result of the investigation, my team implemented more robust policies for our researchers, coached teammates on engaging with threat actors, and took appropriate administrative actions. While we haven't found evidence of illegal conduct, insider activity, or additional disclosures, we are continuing our investigation." Holland, however, has disagreed with the assessment, stating that the employee's actions "meet the definition of an insider threat." The ex-Huntress employee also questioned Huntress if the analyst was permitted to engage with DevMan to "support active investigations." Per Folland, the U.S. Federal Bureau of Investigation (FBI) is said to have contacted the Huntress employee to gather intelligence on DevMan. "She immediately forwarded the exact FBI communications to the threat actor, including screenshots containing FBI agent names," Folland said. "She informed DevMan that law enforcement was actively looking into him. She also refused to cooperate because they wanted DevMan." "This was not just 'poor judgment,'" Folland continued. "This was a Huntress employee taking sensitive knowledge about a law enforcement approach and passing it directly to the person being investigated. If someone inside a bank warns a fraudster that police are investigating them, nobody would describe that as merely 'poor judgment.' They would call it what it is - an insider." (The story was updated after publication on July 28, 2026, to include a response from PRODAFT.)

A new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis), Qilin (aka Pestilent Mantis), and Medusa (aka Venomous Mantis). According to a detailed report published by PRODAFT, the group, which it tracks as Phantom Mantis, is led by a Russian-speaking cybercriminal it calls LARVA-368, who goes by the online aliases hastalamuerte, ArmCorp, zeta88, nobody0, and santamuerte. The Gentlemen is known to be active since March 2025, claiming a total of 478 victims to date, per data from Ransomware.Live. "In July 2025, Phantom Mantis transitioned into The Gentlemen, an independent partnership program no longer dependent on other RaaS groups," the Swiss cybersecurity company said. "Additionally, LARVA-368 relies heavily on artificial intelligence for the development and maintenance of ransomware and tools, as well as for assistance with post-exploitation procedures." As for LARVA-368, the threat actor is assessed to have been a member of the Embargo (aka Primeval Mantis) ransomware group before launching their own operation under the name ArmCorp. It was subsequently rebranded to The Gentlemen four months later. The individual's identity has since been outed by cybersecurity journalist Brian Krebs as a 36-year-old Alexander Andreevich Yapaev (Япаев Алексанр Андреевич) from the Russian city of Izhevsk. PRODAFT told The Hacker News that its findings match the same persona with "high confidence." As detailed by Dark Atlas in August 2025, the shift to a custom ransomware program coincided with a payment dispute between LARVA-368 and Qilin, with the threat actor accusing the RaaS operation of carrying out an exit scam and defrauding them of $48,000. "Although Phantom Mantis was a very active affiliate group with over 20 targets registered on its affiliate panel in less than 30 days, the group's admin (LARVA-368) and LARVA-367 (aka DevMan), a former Phantom Mantis's member, claimed that Pestilent Mantis was scamming affiliates and that there was an alleged 'backdoor' within the Pestilent Mantis's affiliate panel victim chats," PRODAFT noted. "Although we could not confirm these claims, there is a chance that LARVA-368 and LARVA-367 intentionally spread disinformation with the intent of recruiting Pestilent Mantis affiliates to Phantom Mantis by discrediting the group." Phantom Mantis has also been observed paying for Premium accounts on underground forums to boost their visibility and fend off competition, with the group's communication and the technical support handled by a separate Russian-speaking persona named The Gentlemen Data. Some of the other salient aspects of the extortion scheme compiled from various reports are as follows - In an analysis of the ransomware in late last year, LevelBlue's Cybereason team described The Gentlemen as a "highly adaptive, fast-moving ransomware operation" that combines mature ransomware techniques with RaaS features, double extortion, cross-platform lockers, and flexible propagation, and affiliate support. The group has emerged as one of the most active threat actors, accounting for 10% of ransomware activity in April 2026. "The Gentlemen follows an enterprise-focused chain beginning with initial access, via vulnerable internet-facing services or stolen credentials," NCC Group said. "Analysis suggests The Gentlemen can adapt and change tactics during an attack, such as manipulating GPOs, compromising privileged accounts, and using custom methods to bypass endpoint protections." Only about 13% of their victims are based in the U.S. The majority of the victims are concentrated in Thailand, the U.K., Brazil, Germany, and India. LARVA-368 uses The Gentlemen IM app accounts to support affiliates regarding encryption and any intrusion-related issue, such as providing EDR killers to bypass security solutions via the bring your own vulnerable driver (BYOVD) technique. Support services for both The Gentlemen and The Gentlemen Data are available via Tox, SimpleX Chat, and Ricochet Refresh open-source messaging platforms. Potential affiliates are required to provide the administrator at least 1GB of data exfiltrated from a victim to gain access to the affiliate panel, a tactic designed to prevent researchers and law enforcement authorities from gaining access to the infrastructure under the guise of an affiliate. The affiliate panel supports user management, configuring new targets, and downloading ransomware to a specific target. Phantom Mantis provides five versions of ransomware that are designed for Windows, Linux, ESXi, Windows XP+, and Logical Volume Manager (LVM). The group courts affiliates with an aggressive profit-sharing model: 90% for affiliates and 10% for the operator. Initial access is obtained via edge devices such as VPN appliances, firewalls, and other internet-facing systems, with a specific focus on platforms like Cisco and Fortinet FortiGate. Infection chains involve the use of red team utilities like NetExec, RelayKing, TaskHound, PrivHound, and CertiHound to perform Active Directory discovery, certificate abuse, privilege escalation, and file share discovery. A separate set of tools, such as EDRStartupHinder, gfreeze, glinker, and DumpBrowserSecrets, are used for evading security programs, while Velociraptor is employed for command-and-control (C2). The attacks also attempt to clear System, Application, and Security Windows Event Logs, disable Microsoft Defender, and add antivirus exclusions. The ransomware makes use of a hybrid cryptographic scheme: X25519 key exchange combined with XChaCha20 symmetric encryption. Microsoft, which is tracking the cluster under the moniker Storm-2697, said the ransomware is written in Go and obfuscated with Garble to target the Windows environment. "When enabled with the --spread argument, it turns the malware from a single-host encryptor into a self-propagating worm that attempts to deploy its encryptor to every reachable system on the network," the tech giant said. "If the --wipe argument is provided, The Gentlemen ransomware performs an additional post-encryption routine to eliminate recoverable artifacts from disk." According to ZeroFox, the ransomware crew likely runs a multi-channel extortion operation, combining ransomware attacks with email outreach and phone-based pressure tactics targeting victims. The group implements a "highly responsive development cycle," an aspect exemplified by the release of a same-day patch after a decryptor was released in April 2026. The average dwell time of an intrusion ranges from two to six weeks from initial access to encryption, with the group particularly focusing on organizations running VMware infrastructure. Last month, a leak of an internal Rocket.Chat database used by the group - comprising 3,366 messages between November 2025 to late April 2026 - has shed further light on the group's inner workings, including its use of known security flaws in VMware Aria Operations, Fortinet, Cisco, and Microsoft software, while painting a picture of a criminal enterprise whose members have a clear division of roles and responsibilities. "The group actively tracks and evaluates modern vulnerabilities, including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, and combines them with technique-driven paths like backup and management-controller abuse and NTLM relay workflows, giving them a flexible exploitation pipeline," Check Point said. That's not all. In March 2026, Hunt.io said it discovered an open directory hosted at "176.120.22[.]127:80" on the Russian bulletproof hosting provider Proton66 that exposed 126 files containing a complete ransomware operator toolkit attributed to a The Gentlemen RaaS affiliate. This included tools for reconnaissance, privilege escalation, defense evasion, credential theft, lateral movement, persistence, and pre-encryption preparation, essentially spanning all phases of the intrusion lifecycle. "LARVA-368 is a threat actor specializing in extortion-related activities and has been active since at least 2020," PRODAFT said. "The expertise acquired through previous collaborations with various RaaS groups provided the technical foundation necessary to establish The Gentlemen RaaS."

Greg Linares (AKA Laughing Mantis) joins us to tell us about how he became the youngest hacker to be arrested in Arizona. Follow Greg on Twitter: https://x.com/Laughing_Mantis. Sponsors Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com. This show is sponsored by Red Canary. Red Canary is a leading provider of Managed Detection and Response (MDR), helping nearly 1,000 organizations detect and stop threats before they cause harm. With a focus on accuracy across identities, endpoints, and cloud, we deliver trusted security operations and a world-class customer experience. Learn more at redcanary.com. This show is sponsored by Miro. AI doesn’t have to be intimidating—in fact, it can help your team thrive. Miro’s Innovation Workspace changes that by bringing people and AI together to turn ideas into impact, fast. Whether you’re launching a new podcast, streamlining a process, or building the next big thing, Miro helps your team move quicker, collaborate better, and actually enjoy the work. Learn more at https://miro.com/. Attribution Darknet Diaries is created by Jack Rhysider. Assembled by Tristan Ledger. Episode artwork by odibagas. Mixing by Proximity Sound. Theme music created by Breakmaster Cylinder. Theme song available for listen and download at bandcamp. Or listen to it on Spotify. Transcript [START OF RECORDING] JACK: [App beeping] Hey. DAD: Man, I don’t see you. JACK: Yeah, my tape is usually over my camera. DAD: Why don’t I see you? JACK: I got my tape on my camera. One second. DAD: Ah. I can’t even hear you. JACK: You can’t hear me? DAD: My sound… JACK: [Background talk] There’s a story I had that I totally forgot about but I remembered recently, and I wanted to call up my dad and walk through it again with him to try to remember how it went.