// THREAT ACTOR
DEVMAN2_
DormantDEVMAN2 is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of DEVMAN2 — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 42
- 2025 183
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
wugurgyscp5rxpihef5vl6b6m5ont3b6sezhl7boboso2enib2k3q6qd.onionDEVMAN 2.0 - Leaked Data snapshot · 2025-09-28 16:05 -
devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onionDevman Ransomware snapshot · 2026-02-16 07:01 -
tygjm32hxyqienrgwxveiaw3azbjmfaln2znn2hldz2oe6v453ngwlyd.onionDEVMAN - Leak Blog snapshot · 2025-12-29 07:12
Recent victims
The 50 most recent victims claimed by DEVMAN2. Total in the index: 225.
| Date listed | Victim | Description |
|---|---|---|
| 2026-02-04 | Crystal Coast Pain Management | SSN, medical data, medical cards |
| 2026-02-03 | ENCOMPASS-INC | Finance documents, clients PII |
| 2026-01-30 | woodwardoralsurgery.com | Patient data, med cards |
| 2026-01-30 | wjnklaw.com | |
| 2026-01-29 | consultaegis.com | The data contains materials of national security including BIO laborat… |
| 2026-01-29 | zallc.org | PII data, SSN´s financial and audit reports. |
| 2026-01-28 | **ps.net | |
| 2026-01-28 | ***vandenberg.com | Client data, HR data |
| 2026-01-28 | tiw-group.com | |
| 2026-01-28 | z*l*c.o*g | PII data, SSN´s financial and audit reports. |
| 2026-01-27 | twi-group.com | |
| 2026-01-26 | c*n**lta**i*.com | The data contains materials of national security including BIO laborat… |
| 2026-01-26 | cs.at | Insurance data, Hr data, client data |
| 2026-01-25 | **.at | |
| 2026-01-24 | ****cr*nem*ds.c*m | Patient data, medical cards clinic records |
| 2026-01-24 | ***-gr*up.com | |
| 2026-01-21 | automax.com | |
| 2026-01-21 | Syrmasgs | |
| 2026-01-21 | ***m*sic.fi | |
| 2026-01-21 | www.****law.com | |
| 2026-01-21 | ***om****s-***.com | |
| 2026-01-21 | www.mims.com | |
| 2026-01-21 | www.saundersandsaunders.com | |
| 2026-01-20 | Bangkok Electronics CO., LTD | |
| 2026-01-20 | Feelfour | |
| 2026-01-20 | SMVTHAILAND.COM | |
| 2026-01-20 | GMA Network | |
| 2026-01-20 | Tvgoiania | |
| 2026-01-20 | Piriou | |
| 2026-01-20 | Toho-co | |
| 2026-01-20 | NSSF | |
| 2026-01-20 | Netstar | |
| 2026-01-12 | klhindustries.com | |
| 2026-01-12 | paragonradiology.com | |
| 2026-01-12 | heitech.com.my | |
| 2026-01-12 | pronaca.com | Financial, contracts HR data |
| 2026-01-12 | consigaz.com.br | |
| 2026-01-12 | sealbeachca.gov | Datatheft 300gb of data stollen includes gov documents, deeds and much… |
| 2026-01-12 | sealbeachpd.com | data theft, evidence, officers personal information police reports, DE… |
| 2026-01-12 | ******m*di*al.com | Patients data, plastic operations data, SSNs |
| 2026-01-12 | ****t*lc*a*tpm.com | Financial, patients data, HR data |
| 2026-01-12 | s***p.com | Case data, atourney client data, hr data |
| 2025-12-28 | Intonu.com | Financial, Hr documents, claims |
| 2025-12-28 | oppor**nity*****.org | Patients data, financial data |
| 2025-12-28 | Jennings SD | Financial data, HR data |
| 2025-12-28 | sharinc.org | Financial, Custommer data |
| 2025-12-25 | kavi.fi | HR data |
| 2025-12-25 | i**o**.us | Financial, Hr documents, claims |
| 2025-12-25 | ***ind***es.com | Hr data, client data |
| 2025-12-22 | Clínica Dávila | Patients' full records, HIV test results, IDs. Throughout a long wait… |