Back to Intelligence

Defending Against DevMan RaaS: Detecting Funky Mantis Build Operations

SA
Security Arsenal Team
July 25, 2026
6 min read

Introduction

In July 2026, PRODAFT revealed details regarding a sophisticated Ransomware-as-a-Service (RaaS) operation tracked as Funky Mantis. This group is behind the DevMan encryption-based cyber incident scheme, distinguished by its operational maturity: a centralized, web-based portal. This "cyber incident-as-a-service" platform allows affiliates to offload the technical complexities of ransomware deployment by providing a dedicated interface for malicious code builds, victim oversight, and financial management (affiliate payouts).

For defenders, this represents a critical shift in the threat landscape. The commoditization of attack infrastructure via web portals lowers the barrier to entry for cybercriminals, increasing the volume of potential attacks. Security teams must move beyond traditional file-based detection and focus on the behavioral indicators of these RaaS toolsets, specifically the "build generation" processes and the network traffic associated with victim management panels.

Technical Analysis

Threat Overview

  • Threat Actor: Funky Mantis
  • Malware Family: DevMan RaaS
  • Mechanism: Web-based RaaS Portal (Cyber Incident-as-a-Service)

Attack Chain and Methodology

The DevMan RaaS model operates as a centralized service:

  1. Access: Affiliates gain access to a dedicated web platform. This platform serves as the command and control (C2) and administrative hub for the operation.
  2. Payload Generation (The Build Process): Unlike traditional ransomware where affiliates receive a static binary, the DevMan portal enables centralized malicious code builds. Affiliates likely configure payloads (encryption keys, target IDs, ransom notes) via the web interface, and the platform generates the tailored malicious code on demand. This bypasses many static signature detections, as each payload can be unique to the build request.
  3. Victim Management: The portal integrates "victim management" capabilities, allowing affiliates to track the status of compromised machines, encryption progress, and negotiations within the same dashboard used for financial tracking.
  4. Execution: The generated payload is delivered to the target network, likely via initial access vectors (e.g., phishing, exposed RDP). Once executed, the malware establishes a connection back to the portal infrastructure for status updates.

Exploitation Status

PRODAFT has confirmed the active tracking of this infrastructure. The "in-the-wild" status is high, as the portal is currently operational and servicing affiliates. The use of a web-based builder suggests a high degree of automation and agility in the attackers' deployment cycle.

Detection & Response

Given the lack of static IOCs (hashes) in the reporting, defenders must rely on behavioral detection. The primary indicators are the execution of newly built payloads and the network traffic associated with the affiliate portal interactions.

Sigma Rules

The following rules target the behavioral components of the DevMan RaaS operation: the local execution of a freshly built payload and the network connection to the management infrastructure.

YAML
---
title: DevMan RaaS - Suspicious Payload Execution via Web Build
id: 8f4d2a10-9b3c-4d1e-8f5a-1b2c3d4e5f6a
status: experimental
description: Detects the execution of payloads potentially generated by the DevMan RaaS web portal. Identifies processes spawned from user directories with network connectivity and high-entropy command lines common in generated malware.
references:
 - https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith: '.exe'
   CurrentDirectory|contains: 
     - '\Users\'
     - '\Downloads\'
   CommandLine|contains:
     - '-id'
     - '-key'
     - '-config'
 condition: selection | count(CommandLine) > 10
falsepositives:
  - Legitimate administrative tools run from user directories
level: high
---
title: DevMan RaaS - Affiliate Portal Network Connection
id: 1a2b3c4d-5e6f-7890-1a2b-3c4d5e6f7890
status: experimental
description: Detects potential connections to the DevMan RaaS management portal. Looks for browsers or utilities making connections to non-standard ports often used for admin panels.
references:
 - https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   DestinationPort:
     - 8080
     - 8443
     - 9000
     - 3000
   Initiated: true
   Image|endswith:
     - '\chrome.exe'
     - '\msedge.exe'
     - '\firefox.exe'
     - '\curl.exe'
 filter:
   DestinationHostname|contains:
     - 'microsoft.com'
     - 'google.com'
     - 'amazonaws.com'
 condition: selection and not filter
falsepositives:
  - Access to local development servers or legitimate web apps
level: medium

KQL (Microsoft Sentinel / Defender)

This hunt query correlates process creation with network connections to identify processes originating from user directories that immediately establish outbound C2 traffic, a hallmark of RaaS payloads.

KQL — Microsoft Sentinel / Defender
let TimeWindow = 1h;
let SuspiciousProcesses = 
  DeviceProcessEvents
  | where Timestamp > ago(TimeWindow)
  | where FolderPath startswith @"C:\Users\" 
  | where ProcessVersionInfoCompanyName == "" or ProcessVersionInfoOriginalFileName == ""
  | project Timestamp, DeviceName, ProcessId, ProcessName, FolderPath, SHA256, AccountName;
let NetworkConnections = 
  DeviceNetworkEvents
  | where Timestamp > ago(TimeWindow)
  | where RemotePort has_any (8080, 443, 80)
  | project Timestamp, DeviceName, InitiatingProcessId, RemoteIP, RemoteUrl, RemotePort;
SuspiciousProcesses
| join kind=inner (NetworkConnections) on $left.Timestamp == $right.Timestamp, $left.DeviceName == $right.DeviceName, $left.ProcessId == $right.InitiatingProcessId
| project Timestamp, DeviceName, AccountName, ProcessName, FolderPath, SHA256, RemoteIP, RemoteUrl

Velociraptor VQL

This VQL artifact hunts for unsigned executables running from user profiles that have active network connections, indicative of an active affiliate connection to the DevMan portal.

VQL — Velociraptor
-- Hunt for DevMan RaaS Affiliate Connections
SELECT 
  p.Name as ProcessName, 
  p.Pid, 
  p.Exe as Path, 
  p.Username,
  p.CommandLine,
  c.RemoteAddress,
  c.RemotePort
FROM pslist(pids=netstat().Pid) p
JOIN netstat() c ON p.Pid = c.Pid
WHERE 
  p.Exe =~ '^C:\Users\.*\\.*\.exe$'
  AND NOT p.Signed
  AND c.State = 'ESTABLISHED'
  AND c.RemotePort != 0

Remediation Script (PowerShell)

Use this script to audit recent executions from user directories that match the behavioral profile of generated payloads and block the current user if suspicious activity is confirmed.

PowerShell
# Audit and Block DevMan RaaS Generated Payloads
# Requires Administrator Privileges

Write-Host "[+] Scanning for suspicious unsigned executables in User profiles..." -ForegroundColor Cyan

$suspiciousProcesses = Get-WmiObject Win32_Process | Where-Object { 
    $_.ExecutablePath -match "C:\Users\" -and 
    $_.ExecutablePath -match "\.exe$"
}

foreach ($proc in $suspiciousProcesses) {
    $sig = Get-AuthenticodeSignature -FilePath $proc.ExecutablePath
    
    if ($sig.Status -ne "Valid") {
        $networkConnections = Get-NetTCPConnection -OwningProcess $proc.ProcessId -ErrorAction SilentlyContinue
        
        if ($networkConnections) {
            Write-Host "[!] ALERT: Suspicious unsigned process with network activity found!" -ForegroundColor Red
            Write-Host "    PID: $($proc.ProcessId)"
            Write-Host "    Path: $($proc.ExecutablePath)"
            Write-Host "    User: $($proc.GetOwner().User)"
            
            # Optional: Kill process and block IP
            # Stop-Process -Id $proc.ProcessId -Force
            # Write-Host "    Process terminated."
        }
    }
}

Write-Host "[+] Scan complete. Review alerts for immediate action." -ForegroundColor Green

Remediation

  1. Isolate Affected Systems: If the DevMan payload has been executed, immediately isolate the host from the network to prevent further communication with the Funky Mantis portal.
  2. Block Portal Infrastructure: While specific IPs are not public, work with your threat intelligence provider (e.g., PRODAFT, commercial feeds) to identify and block the IP ranges and domains associated with the DevMan RaaS portal immediately upon publication.
  3. Audit Admin Panels: Review logs for any successful RDP or VPN logins that might indicate how the affiliate gained initial access to deploy the payload.
  4. User Awareness: Train security operations teams to look for "admin" or "portal" type traffic on non-standard ports originating from endpoints, as this is distinct from standard web browsing.
  5. Credential Reset: Assume that credentials stored on the affected machine have been harvested. Force a password reset for all accounts used on the compromised endpoint.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub

healthcare-cybersecurityhipaa-compliancehealthcare-ransomwareehr-securitymedical-data-breachdevman-raasfunky-mantisransomwarethreat-huntingdetection

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action